CrowdSec: Departed Employee’s Live GitHub Access → ~170 Private Repos Cloned

The breach wasn’t a novel zero-day on CrowdSec’s product. It was an offboarding gap: a former employee’s GitHub org access stayed open, his laptop had been hit by the TanStack npm credential stealer, and on May 22 an attacker cloned about 170 private repositories.

What happened

CrowdSec disclosed in mid-September 2026 that private source (SaaS console, automations, data-science code, consensus logic) appeared online. Their September 18 analysis says the copy used a GitHub OAuth token from an employee who had just left, whose access CrowdSec had intentionally kept open so he could finish work. The laptop was compromised in the TanStack supply-chain attack (CVE-2026-45321, malicious npm packages published May 11 that stole GitHub tokens, SSH keys, and cloud credentials).

Timeline that matters for operators:

• May 11 — malicious TanStack packages published
• May 22 — ~170 private CrowdSec repos cloned via the retained account/token
• May 25 — CrowdSec removed the account from the GitHub org (other access already revoked — which is why AWS looked quiet)
• Sep 16–18 — archive surfaces; CrowdSec investigates with GitHub support; public statements evolve (first statement minimized client/investor exposure; later report acknowledges 83 user emails and 51 investor records from a 2020 system)

CrowdSec says infrastructure/databases were not accessed, code was not modified, and usable credentials in the archive were limited (one SNS publish attempt Aug 17 went nowhere). Thresholds for their consensus blocklist became public; they argue poisoning remains costly.

Why it matters

Two ordinary failures lined up: a supply-chain steal on a developer endpoint, and identity offboarding that stopped at the IdP while GitHub (and similar) stayed live. That pattern is not unique to CrowdSec — Mistral and OpenAI reported related TanStack exposure. If your offboarding checklist doesn’t include GitHub/GitLab org membership, personal PATs, OAuth apps, cloud console roles, package registries, and CI secrets, you are rehearsing this incident.

What to do first

• Audit departed and departing users across GitHub/GitLab/Bitbucket orgs: members, outside collaborators, pending invites, personal access tokens, SSH keys, OAuth apps, and GitHub Apps.
• Enforce immediate revoke on last day — “finish the work” gets a time-boxed break-glass account you control, not a retained personal identity.
• Require phishing-resistant MFA + short-lived credentials on code hosts; ban long-lived classic PATs where possible.
• Deploy/verify endpoint protection on developer laptops that touch private code (CrowdSec noted they did not require it at the time; they do now).
• Monitor for mass git clone / unusual GraphQL enumeration from org tokens; alert on new OAuth grants.
• If you consume CrowdSec blocklists: no user action required per CrowdSec — but review whether leaked consensus thresholds change your trust assumptions.
• Rotate any CI/CD and cloud tokens that ever lived in private repos; assume historical secrets are burned.

Details

• Victim: CrowdSec (private GitHub repositories)
• Vector: TanStack npm credential theft (CVE-2026-45321) → retained ex-employee GitHub OAuth access
• Impact: ~170 private repos cloned May 22, 2026; later public dump; limited PII (user emails / old investor records) per later disclosure
• Not impacted (per CrowdSec): production databases / customer logs store; open-source Security Engine (public by design)

Hunt / verify

• SIEM: GitHub audit log — repo.clone, git.clone, org member removals vs. last HR termination dates.
• Compare offboarding tickets to IdP disable time vs. GitHub member-removal time (gap analysis).
• Secret scanning across your own private repos for tokens that match patterns seen in similar leaks.
• Inventory npm/yarn lockfiles for TanStack packages around May 2026 versions; confirm developer endpoints were cleaned.

Sources

• https://www.crowdsec.net/blog/crowdsec-statement-source-code-exposure
• https://www.crowdsec.net/blog/tanstack-supply-chain-attack-analysis
• https://thehackernews.com/2026/09/crowdsec-says-tanstack-npm-attack-led.html

George Bailey

George Bailey is a cybersecurity researcher and writer at CyberExperts, covering cyber threats, AI, cloud security, vulnerabilities, and defensive strategies. His goal is to help security professionals quickly understand what matters most and how it impacts their organizations.