CrowdSec: Departed Employee’s Live GitHub Access → ~170 Private Repos Cloned

CrowdSec’s source-code leak started with an offboarding gap. A former employee’s GitHub org access stayed open after he left. His laptop had been hit by the TanStack npm credential stealer, and on May 22 an attacker cloned about 170 private repositories.

A retained OAuth token and the TanStack stealer

CrowdSec disclosed in mid-September 2026 that private source (SaaS console, automations, data-science code, consensus logic) appeared online. Their September 18 analysis says the copy used a GitHub OAuth token from an employee who had just left, whose access CrowdSec had intentionally kept open so he could finish work. The laptop was compromised in the TanStack supply-chain attack (CVE-2026-45321, malicious npm packages published May 11 that stole GitHub tokens, SSH keys, and cloud credentials).

Timeline:

• May 11 — malicious TanStack packages published
• May 22 — ~170 private CrowdSec repos cloned via the retained account/token
• May 25 — CrowdSec removed the account from the GitHub org (other access already revoked — which is why AWS looked quiet)
• Sep 16–18 — archive surfaces; CrowdSec investigates with GitHub support; public statements evolve (first statement minimized client/investor exposure; later report acknowledges 83 user emails and 51 investor records from a 2020 system)

CrowdSec says its infrastructure and databases were not accessed and no code was modified. Usable credentials in the archive were limited; one SNS publish attempt on Aug 17 went nowhere. The thresholds behind its consensus blocklist are now public, though CrowdSec argues that poisoning the list is still costly.

Offboarding stopped at the IdP

Two ordinary failures lined up: credential theft on a developer endpoint, and identity offboarding that stopped at the IdP while GitHub (and similar) stayed live. CrowdSec was not alone. Mistral and OpenAI reported related TanStack exposure. An offboarding checklist that skips GitHub/GitLab org membership, personal PATs, OAuth apps, cloud console roles, package registries and CI secrets leaves the same gap open.

Close code-host access on the last day

• Audit departed and departing users across GitHub/GitLab/Bitbucket orgs: members, outside collaborators, pending invites, personal access tokens, SSH keys, OAuth apps, and GitHub Apps.
• Revoke access on the last day. If someone needs to finish work, give them a time-boxed break-glass account you control instead of keeping their personal identity live.
• Require phishing-resistant MFA + short-lived credentials on code hosts; ban long-lived classic PATs where possible.
• Deploy/verify endpoint protection on developer laptops that touch private code (CrowdSec noted they did not require it at the time; they do now).
• Monitor for mass git clone / unusual GraphQL enumeration from org tokens; alert on new OAuth grants.
• If you consume CrowdSec blocklists: CrowdSec says no user action is required. Still, review whether leaked consensus thresholds change your trust assumptions.
• Rotate any CI/CD and cloud tokens that ever lived in private repos; treat old secrets as exposed.

Details

• Victim: CrowdSec (private GitHub repositories)
• Vector: TanStack npm credential theft (CVE-2026-45321) → retained ex-employee GitHub OAuth access
• Impact: ~170 private repos cloned May 22, 2026; later public dump; limited PII (user emails / old investor records) per later disclosure
• Not impacted (per CrowdSec): production databases / customer logs store; open-source Security Engine (public by design)

Hunt / verify

• SIEM: GitHub audit log — repo.clone, git.clone, org member removals vs. last HR termination dates.
• Compare offboarding tickets to IdP disable time vs. GitHub member-removal time (gap analysis).
• Secret scanning across your own private repos for tokens that match patterns seen in similar leaks.
• Inventory npm/yarn lockfiles for TanStack packages around May 2026 versions; confirm developer endpoints were cleaned.

Sources

• https://www.crowdsec.net/blog/crowdsec-statement-source-code-exposure
• https://www.crowdsec.net/blog/tanstack-supply-chain-attack-analysis
• https://thehackernews.com/2026/09/crowdsec-says-tanstack-npm-attack-led.html

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].