An attacker copied about 170 of CrowdSec’s private GitHub repositories on May 22, the company said on September 18, using an OAuth token taken from the account of an employee who had already left the firm.
CVE-2026-45321 and the TanStack npm backdoor
CrowdSec attributes the upstream intrusion to the May supply‑chain compromise of TanStack’s npm packages, tracked as CVE‑2026‑45321. TanStack’s advisory, cited by CrowdSec, says that on May 11 malicious versions — 84 malicious releases across 42 TanStack npm packages — were published and that installing one of those versions executed code that stole credentials from developer machines, including GitHub tokens, SSH keys, and cloud credentials.
Former employee OAuth token, GitHub tracing, and timeline
According to CrowdSec, the attacker used a GitHub OAuth token from a former employee’s account to clone private repositories on May 22. The company had left that employee’s GitHub access active so the person could finish work; other access had already been removed. CrowdSec removed the account from its GitHub organization on May 25, three days after the copy and months before the company learned the code had been posted publicly.
CrowdSec says the token left no trace in the GitHub logs it could check and that the token no longer existed when the company learned of the leak. CrowdSec reports that GitHub support later traced the token’s history and confirmed CrowdSec’s suspicion that TanStack was the source. CrowdSec did not disclose which malicious TanStack package reached the former employee’s laptop or when.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildWhat the leaked archive contained
The materials cloned from CrowdSec’s private repositories appeared on an online forum on September 16. CrowdSec says the archive contained roughly 170 private repositories and included:
- source for the company’s web console, data science scripts and models, automation scripts, and its consensus algorithm that helps build shared blocklists;
- the email addresses of 83 CrowdSec users used internally by the data science team; and
- names, email addresses, and investment context for 51 potential investors from a 2020 system that CrowdSec says was never meant to be public.
CrowdSec says the leaked code is almost four months old and that the project has changed substantially since then. The company reported that the only usable credential in the leak was an AWS SNS notification credential that could publish only to a single topic; an attempted use of that credential occurred on August 17 but “got no further,” and other tokens in the archive had been rotated or could not be used from the internet as far as the company knows.
Blocklist thresholds, integrity, and CrowdSec’s mitigation steps
CrowdSec’s private code includes the consensus algorithm that determines how many detections are required before an IP is added to the shared blocklist. The company acknowledged that the leak revealed thresholds the algorithm uses — values that had not previously been public — but said that, as far as it knows, the blocklist still cannot be poisoned. CrowdSec said an attacker would need “tens of detections from tens of trusted engines across tens of separate networks” to manipulate the blocklist, and that the company can and does change thresholds regularly.
After learning of the breach, CrowdSec rotated the exposed credentials on September 16 and 17 and changed its developer endpoint protections: it now runs endpoint protection software on the laptops of staff who work with its code or systems. The company also says it checked developers’ machines and found them clean.
Other affected companies; investor and user notifications
CrowdSec says the same TanStack supply‑chain attack affected other organizations. Mistral AI reported that a developer device was involved in its case, and OpenAI said two employee devices were affected with unauthorized access to a limited set of its internal code repositories.
CrowdSec says it will contact the 83 exposed users whose email addresses were found in the archive and will report the investor data leak to affected investors and to authorities. CEO Philippe Humeau wrote to the investors in the report, saying “for this I personally apologize.”
How developers, investors, and CrowdSec users are likely to react
- Developers and security teams: will watch for credential‑theft via malicious npm packages and for signs tokens or keys were exfiltrated; CrowdSec has begun requiring endpoint protection for code‑handling staff and rotated exposed credentials.
- Investors named in the 2020 file: will be notified by CrowdSec and by the company to authorities, and have received a direct apology from the CEO.
- CrowdSec users whose emails were exposed: will be contacted by the company; CrowdSec reports about 150,000 total users and says the 83 addresses were retained internally by its data science team for product‑use analysis.
CrowdSec’s account of the incident evolved between its first public statement and the September 18 report. The earlier statement had asserted that “No client data, login/password, name, organization, or anything else was leaked” and named the TanStack compromise as the likely source; the later report pointed to the former employee’s account as the mechanism, and listed the investors’ names and the 83 users’ email addresses that the first statement had said had not leaked. CrowdSec says its infrastructure and databases were not accessed and that the account was used only to copy code; it also says no code was changed.
The public record ends with action: credentials rotated on September 16–17, endpoint protection deployed for code‑handling staff, investor notifications promised, and an apology from CEO Philippe Humeau. GitHub support’s tracing of the token linked the activity back to the TanStack supply‑chain incident, but CrowdSec did not publish GitHub’s own findings nor identify which malicious package reached the ex‑employee’s device.
