On September 18, **CrowdSec** confirmed that an attacker had accessed and copied around 170 of its private GitHub repositories. The incident, which came to light when the code appeared on an online forum on September 16, was traced back to a former employee's GitHub account whose access had not been fully revoked. ### The TanStack Connection **CrowdSec** attributes the compromise to a supply chain attack on **TanStack** in May. This attack, tracked as **CVE-2026-45321**, involved the publication of 84 malicious versions of 42 **TanStack** npm packages. Installing one of these compromised packages executed code designed to steal credentials, including GitHub tokens, SSH keys, and cloud credentials, from developers' machines. According to **CrowdSec**, the former employee's laptop was likely affected by this **TanStack** compromise. An OAuth token from their GitHub account, which remained active to allow for the completion of outstanding work, was subsequently used to exfiltrate the repositories on May 22. The company removed the account from its GitHub organization on May 25, unaware of the breach until months later. Notably, the token left no discernible trace in **CrowdSec**'s accessible GitHub logs, and it no longer existed when the leak was discovered. GitHub support later corroborated **CrowdSec**'s suspicion regarding the **TanStack** compromise as the origin of the token theft. **CrowdSec** did not specify which malicious package was involved or when the employee's machine was infected, nor did it include GitHub's detailed findings in its report. The **TanStack** attack also impacted other organizations, with **Mistral AI** reporting a developer device compromise and **OpenAI** disclosing unauthorized access to a limited set of internal code repositories from two employee devices. ### Scope of the Leaked Data The leaked archive contains code from **CrowdSec**'s private repositories, distinct from its public open-source Security Engine. This includes the web console, data science scripts and models, automation scripts, and the consensus algorithm crucial for determining which IP addresses are added to its shared blocklists. **CrowdSec** emphasized that the code is approximately four months old and has undergone significant changes since the time of the leak. Crucially, the leak also exposed the previously undisclosed thresholds used by the consensus algorithm for adding IP addresses to blocklists. While these thresholds are now public, **CrowdSec** asserts that its blocklist remains resistant to poisoning, requiring substantial resources and coordinated attacks across numerous trusted engines and networks to manipulate. The company also confirmed its ability to modify these thresholds as needed. Regarding credentials, the only usable credential found in the leak was for AWS's SNS notification service, which could only publish messages to a single topic. An attempt to use this credential on August 17, prior to the code being posted, was unsuccessful. Other tokens in the code were either rotated or designed to be unusable from the public internet. In addition to the source code, the leak exposed the email addresses of 83 **CrowdSec** users, collected by its data science team for product usage analysis. The company plans to directly inform these users. Furthermore, details of 51 potential investors from 2020, including their names, email addresses, and investment context, were also compromised. **CrowdSec** CEO **Philippe Humeau** has issued a personal apology to the affected investors and stated that the incident will be reported to relevant authorities. ### Post-Incident Measures and Discrepancies Following the discovery, **CrowdSec** rotated all exposed credentials on September 16 and 17. The company, which previously did not mandate endpoint protection software on developers' machines, has since implemented such software for all staff working with its code or systems. It's important to note that **CrowdSec**'s September 18 report provided a more detailed and revised account compared to its initial statement published a day earlier. The initial statement asserted that "No client data, login/password, name, organization, or anything else was leaked" and suggested the impact was limited to the company. It also initially pointed to a backdoored component as the likely source of an API key theft. The subsequent report clarified that no malicious **TanStack** versions were found in **CrowdSec**'s code directly, shifting the focus to the former employee's compromised account and disclosing the user email addresses and investor details previously omitted. Neither of **CrowdSec**'s statements has advised users to take any specific actions in response to the breach.