A Token That Should Have Been Revoked
French cybersecurity firm CrowdSec disclosed on September 18, 2026 that an attacker copied roughly 170 of its private GitHub repositories back on May 22, 2026 — using a GitHub OAuth token belonging to a former employee whose access had never been revoked. CrowdSec said it kept the ex-employee's GitHub access open "so he could finish some work," while his other systems access had already been removed. That partial offboarding is why the intrusion left no trace in the logs CrowdSec was actively monitoring.
The Root Compromise: TanStack's May npm Attack
The former employee's laptop was infected through the TanStack npm supply chain attack, tracked as CVE-2026-45321. On May 11, 2026, attackers published malicious versions of 42 TanStack npm packages containing code that stole credentials directly from developer machines — GitHub tokens, SSH keys, and cloud credentials among them. CrowdSec has not specified which malicious package version reached the employee's device or exactly when.
Eleven days later, on May 22, the attacker used the stolen token to copy the 170 repositories. CrowdSec removed the former employee's GitHub access on May 25 — three days after the theft, but with no indication at the time that anything had happened.
What Was Taken
The stolen archive, roughly four months old at the time of discovery, included:
- 170 private GitHub repositories — source code for CrowdSec's web console, internal data science scripts, automation tooling, and the consensus algorithm that determines when an IP address gets added to CrowdSec's crowdsourced blocklist
- 83 user email addresses pulled from a product research database
- 51 potential investor records from a 2020-era system, including names and investment context
Timeline
| Date | Event |
|---|---|
| May 11, 2026 | Malicious TanStack npm packages published (CVE-2026-45321) |
| May 22, 2026 | Attacker copies 170 repos using the ex-employee's still-valid GitHub token |
| May 25, 2026 | CrowdSec revokes the former employee's GitHub access |
| August 17, 2026 | Unauthorized attempt to use an exposed AWS SNS credential detected |
| September 16, 2026 | Stolen code archive posted on an online forum |
| September 16–17, 2026 | CrowdSec rotates all exposed credentials |
| September 18, 2026 | CrowdSec publishes its full incident report |
Response and Broader Fallout
CrowdSec has since rotated all exposed credentials, deployed endpoint protection software on developer machines with access to sensitive code, and begun notifying the users whose emails were exposed, with outreach to affected investors and regulators planned. CEO Philippe Humeau personally apologized to investors in the company's disclosure.
CrowdSec is not the only organization caught up in the TanStack compromise: Mistral AI reported a compromised developer device, and OpenAI disclosed that two employee devices were affected, giving attackers access to a limited set of its internal code repositories.