2026 CrowdSec — TanStack npm → ex-employee GitHub token; ~170 private repos + user/investor emails
Data compromised
Private SaaS/console/AWS/automation source code (~170 repos) posted to a forum Sep 16; 83 CrowdSec user emails; names/emails/investment context for 51 potential investors (2020). Infrastructure/databases not accessed; no code modified. Limited SNS credential attempted Aug 17.
Technical writeup
Verified CrowdSec statements — September 17–18, 2026. Leak discovered after Sep 16 forum post of May 22 clones. Root cause: TanStack npm credential stealer on departing employee’s laptop; GitHub OAuth token cloned ~170 private repos while org access still open (removed May 25). Sep 18 report confirms 83 user emails + 51 investor contacts in archive (revising Sep 17 “no PII” line). recordsAffected 134 (83+51); companyConfirmed true.
Root cause
Former employee laptop hit by TanStack npm supply-chain stealer (CVE-2026-45321); GitHub OAuth token used May 22 to clone ~170 private repos while offboarding access remained open