CrowdSec Leak: 170 Private Repos After TanStack Stealer

CrowdSec confirmed that a May 2026 GitHub cloning spree copied roughly 170 private repositories after a departing employee’s laptop caught the TanStack npm credential stealer tied to CVE-2026-45321. The archive surfaced on a forum in mid-September; by 18 September the French security vendor revised its story to include 83 user emails and contact context for 51 potential investors from 2020—not “source code only.”

This is a verified supply-chain plus offboarding failure, not a ransomware headline. Databases and production infrastructure were not accessed, CrowdSec says, and no repository contents were modified. Yet full private SaaS, console, AWS automation, and security-tooling source is a gift to attackers hunting logic bugs, hard-coded secrets, and customer-deployment patterns. If you run CrowdSec or forked its stack, treat September 2026 as a rotation and patch milestone.

How CrowdSec fits the threat landscape

CrowdSec builds collaborative intrusion detection: IP reputation, bouncers, and community blocklists deployed on Linux servers and cloud estates. Its GitHub org holds the implementation details adversaries need to evade detections or craft targeted exploits against installations worldwide. Losing ~170 private repos is closer to losing a product’s crown jewels than losing a marketing site.

Attack chain—verified sequence

22 May 2026 — An attacker used a GitHub OAuth token associated with a former employee to clone approximately 170 private repositories. CrowdSec states the token still worked because offboarding had not yet removed org access.

25 May 2026 — Organization access for the departing employee was removed—three days after the clones.

Root cause on the laptop: infection via the TanStack npm supply-chain attack (CVE-2026-45321), a stealer delivered through compromised npm packages that harvest developer credentials. CrowdSec published a dedicated analysis at crowdsec.net/blog/tanstack-supply-chain-attack-analysis.

16 September 2026 — Forum post published the May 22 clone archive, triggering discovery.

17–18 September 2026 — CrowdSec statements (source code exposure) disclosed scope and walked back an earlier “no PII” framing once emails and investor contacts were found inside the tarball.

17 August 2026 — Separate limited attempt to use SNS credentials; CrowdSec lists this as unsuccessful in the catalog technical writeup.

What was exposed

• ~170 private GitHub repositories — SaaS, console, AWS automation, and security product source code
• 83 CrowdSec user email addresses embedded in the leaked archive
• 51 potential investor contacts (2020) — names, emails, investment context

Catalog recordsAffected: 134 reflects 83 + 51 contact rows, not lines of code.

What CrowdSec says was not compromised

• Production infrastructure and customer databases
• Integrity of code—clones, not in-repo tampering
• Broader customer PII beyond the 83 emails identified in the leak bundle

“No database breach” does not mean “no security impact.” Source leaks accelerate zero-day discovery against downstream users.

Who should care

CrowdSec enterprise and community users

Attackers with the repo tree can diff releases, hunt deprecated auth paths, and craft exploits against bouncer deployments. Rotate API keys, console credentials, and any custom integration secrets you based on CrowdSec examples—even if CrowdSec’s SaaS backend was untouched.

The 83 emailed users

Expect targeted phishing referencing CrowdSec updates, fake “mandatory console migrations,” or npm install instructions. Your email is now a known pivot from a public leak thread.

Investors on the 2020 list

Investment context plus email enables BEC and fake cap-table messages. Not payment-card data, but enough for convincing social engineering.

Developers on TanStack-adjacent stacks

CVE-2026-45321 is the wider lesson: any machine that ran compromised TanStack packages during the campaign may harbor stolen Git, cloud, and npm tokens. CrowdSec is one named victim; your org may be another without knowing yet.

Security vendors generally

Leaked defensive code helps attackers test evasion before touching production sensors. Red teams will mine the archive; so will criminals.

TanStack npm supply chain in context

September 2026’s TanStack incident belongs to a brutal year for npm trust: typosquats, maintainer compromises, and stealers bundled into build chains. CrowdSec’s public writeup ties its employee laptop compromise directly to that campaign—useful evidence when persuading leadership to lock down developer workstations with the same rigor as production VPCs.

Compare BreachHistory’s OpenAI eval isolation breakout and Brevo Cloudflare key theft: different vectors, same theme—peripheral systems (dev laptops, API keys, eval sandboxes) becoming the soft path to high-value assets.

Offboarding gap: three days of org access

Security teams preach “disable GitHub on last day.” CrowdSec’s timeline shows why: May 22 clones, May 25 removal. Automated offboarding tied to HRIS termination, same-day OAuth revocation, and GitHub audit log alerts for mass clone events would have shrunk that window to hours—or triggered an incident on the 22nd itself.

Phishing and abuse scenarios

• “Critical CrowdSec patch—run this install script” hosting malware styled like bouncer packages
• “Your console API key expired—paste new key here” at a look-alike domain
• “Investor update: CrowdSec breach settlement wire instructions” targeting the 2020 list
• Fake TanStack security advisories urging `npm install` of malicious “fixed” packages

What CrowdSec and press reported

Primary source: CrowdSec’s two September 2026 blog posts on the TanStack analysis and source exposure. The Hacker News summarized the npm-to-GitHub chain for a broader audience. The Sep 18 revision acknowledging emails and investor contacts is material—early “code only” messaging underestimated archive contents.

Action items

1. Audit developer machines for TanStack/npm packages linked to CVE-2026-45321; rebuild from clean lockfiles if exposure is possible.
2. Revoke and reissue GitHub tokens for anyone who left the org in Q2 2026 without same-day org removal.
3. Enable GitHub audit log alerts for bulk clone/download patterns from single tokens.
4. Rotate CrowdSec console and API credentials if you deploy their stack, even without a personal notice.
5. Warn the 83 users if you operate a CrowdSec-powered service that forwarded their emails into configs later mirrored in repos.
6. Scan cloned code trees (if you mirror CrowdSec privately) for secrets that should be rotated regardless of CrowdSec’s infra assessment.
7. Review investor comms channels for BEC hardening if your firm appears in the 2020 contact set.

Legal and customer communication angle

GDPR and French CNIL expectations for 134 contact records may differ from a 170-repo source leak, but enterprise customers will ask for customer-notification timelines and whether SLA/security exhibit terms trigger. CrowdSec’s transparency on revising the PII statement is the right direction; customers should still demand a software bill of materials showing which private modules touched their deployments.

Inside the May 22–25 window

GitHub Enterprise audit logs record clone events, IP addresses, and token IDs. CrowdSec’s public timeline implies those logs existed internally even if not shared. Security teams elsewhere should verify their SIEM alerts on “>50 repos cloned in one hour” fire during offboarding windows—exactly when HR thinks the person is gone but IT access lingers.

The former employee’s laptop infection via TanStack npm means the token may have been exfil automatically by the stealer before any human attacker targeted CrowdSec specifically. That distinction matters for threat modeling: you are not only defending against someone who knew CrowdSec’s org chart; you are defending against commodity malware that harvests whatever OAuth tokens exist on disk.

Why source code leaks hurt defenders first

Private repositories for a collaborative IPS include detection rules, false-positive tuning, parser edge cases, and integration glue for cloud APIs. Attackers study them to craft traffic that blends into allowed telemetry or to find hard-coded test keys that also work in customer-facing appliances. CrowdSec states production databases were untouched; the countermeasure is still accelerated rule rotation and assumption that obscurity is gone.

If you forked CrowdSec modules privately, diff your forks against public releases once CrowdSec publishes integrity-checked tags post-incident. Merge security patches without importing leaked private-only experiments back into your tree.

CVE-2026-45321 operational checklist

CrowdSec’s TanStack analysis blog is the authoritative breakdown for how packages were poisoned and what indicators to hunt. Generic checklist while reading that post: inventory all projects with TanStack dependencies; compare lockfile versions against vendor advisory ranges; rebuild node_modules from clean caches; rotate npm tokens and GitHub PATs on any machine that ran installs during the campaign window; scan for unexpected cron jobs or shell profiles added post-install.

Developers on macOS and Linux are equally in scope—stealers do not respect platform stereotypes. CI runners that executed npm install during builds may have stored tokens in environment logs; rotate CI secrets if builds touched TanStack trees in Q2 2026.

Investor list from 2020: why old CRM exports linger

The 51 investor contacts dated to 2020 illustrate how backup tarballs and old fundraising spreadsheets hitchhike inside org repos long after rounds close. Email addresses age slowly; a seed investor’s inbox in 2026 is still valid for BEC. CrowdSec’s revision to include this set is a reminder that “private repo” does not mean “curated minimal data”—it means whatever engineers committed for convenience.

Enterprise customer questions to ask CrowdSec

If you deploy bouncers or consume blocklists, ask your account team: which private modules, if any, map to your deployment; whether incident response retriever tokens were present in leaked code; expected timeline for additional secret rotation; and whether threat-intel feeds will incorporate attacker knowledge gained from the leak. Document answers for your own SOC audits.

Supply-chain incident stacking in 2026

CrowdSec sits between npm malice and GitHub credential abuse—the same stack Haruko’s process-token theft exploited in crypto infrastructure, though Haruko’s vector was process memory rather than npm. The meta-lesson for CISOs: developer endpoints are production attack surface, not “IT will handle leavers eventually.”

Canonical record and sources

2026 CrowdSec — TanStack npm → ex-employee GitHub token; ~170 private repos

• CrowdSec — statement on source code exposure
• CrowdSec — TanStack supply chain attack analysis
• The Hacker News — TanStack npm attack led to GitHub leak

Keywords: CrowdSec data breach, CrowdSec GitHub leak, TanStack npm CVE-2026-45321, supply chain attack 2026. The verified facts are the May 22 clone event, September forum disclosure, 170 repos, 83 user emails, 51 investor contacts, TanStack stealer on a leaver laptop, and a three-day delayed GitHub offboarding window—fix those processes before the next npm campaign names your org.

Forum disclosure dynamics

Leaks often appear on forums before vendors finish internal investigations. CrowdSec’s September 16 discovery via forum post implies the clone sat unnoticed for nearly four months. Other companies should hunt for their org names on the same forums proactively rather than waiting for a researcher email.

GitHub token scope minimization

OAuth tokens that can read all private repos are convenient for platform engineers and catastrophic on laptops that install npm packages. Short-lived fine-grained tokens, per-repo access, and hardware-bound SSH commit signing reduce blast radius when stealers land on a departing employee machine.

Red team vs real adversary

Source code in attacker hands enables zero-day discovery against CrowdSec users worldwide. Treat the incident like a critical CVE even without a CVSS score assigned yet—patch operational assumptions (rules, keys, deployment configs) on your side while CrowdSec completes its post-mortem.

Incident timeline for SOC handoffs

When briefing your security operations center, line up dates: May 22 clone, May 25 access removal, August 17 SNS credential attempt (limited, per catalog), September 16 forum post, September 17–18 CrowdSec public statements including PII revision. That chronology helps correlate unrelated alerts on your network that might have coincided with CrowdSec product changes rather than attacker activity against you.

Dependency confusion and npm trust

TanStack’s brand recognition made it attractive for supply-chain attackers because developers treat @tanstack packages as mainstream utilities. Lockfile integrity, npm provenance where available, and internal mirrors for critical builds reduce but do not eliminate stealer risk on endpoints. Combine package hygiene with EDR on engineer laptops—the CrowdSec leaver machine was the bridge, not GitHub itself.

User email exposure: 83 rows

Eighty-three CrowdSec user emails in a forum tarball is small compared to consumer mega-breaches but concentrated among people who likely run security tooling at their employers. Spear-phishing those inboxes may aim at lateral movement into their companies, not at CrowdSec alone. If you are a CrowdSec user, verify sender domains on any “mandatory security update” message in the weeks after September 2026.

Mapping to MITRE ATT&CK without overclaiming

Public facts support supply-chain initial access (compromised npm dependency), credential access (stolen GitHub token), and collection (repo cloning). CrowdSec denies impact on production infrastructure—no public evidence of impact stage against CrowdSec SaaS databases. Your threat model should include exfiltration of intellectual property leading to follow-on attacks against deployments, which is a strategic risk rather than a single CVE patch.

Schedule a tabletop exercise where engineers walk through revoking a leaver’s tokens in under one hour, measuring gap against CrowdSec’s three-day window. Tabletop outcomes belong in your Q4 remediation roadmap regardless of whether you use CrowdSec products.

If your organization mirrored CrowdSec detection rules privately, assume those forks may need rewrites if public diffs reveal which heuristics were secret sauce versus already open source.

Human resources and IT must share termination timestamps in real time: CrowdSec’s May 22–25 gap is a process failure more than a tooling mystery. Automate GitHub org removal tied to HRIS status the same hour access badges deactivate.

Threat intelligence teams should monitor for exploits targeting CrowdSec parser logic discussed in leaked repos and publish detection updates to customers without waiting for CVE assignment if active exploitation appears.

Include TanStack dependency versions in your next SOC 2 evidence pack; auditors increasingly ask how npm supply-chain incidents map to change control on engineer laptops.

Rotate any GitHub personal access tokens stored in password managers on machines that ever installed TanStack packages during the CVE-2026-45321 window, even if you never worked at CrowdSec.