Full Report
An attacker copied about 170 of CrowdSec's private GitHub repositories on May 22 using the account of an employee who had just left, CrowdSec said on September 18. The French security company had kept his GitHub access open. CrowdSec says his laptop was compromised in May's supply chain attack on TanStack, in which malicious versions of TanStack's npm packages stole credentials from
Analysis Summary
# Incident Report: CrowdSec GitHub Repository Exfiltration via TanStack Supply Chain Attack
## Executive Summary
CrowdSec, a French cybersecurity firm, suffered a data breach where an attacker exfiltrated 170 private GitHub repositories. The breach originated from a supply chain attack on TanStack npm packages, which compromised a former employee's laptop and stole GitHub OAuth tokens. The exfiltrated data included proprietary source code, internal algorithms, and a limited set of user and investor PII.
## Incident Details
- **Discovery Date:** September 16, 2026 (via public forum leak)
- **Incident Date:** May 22, 2026
- **Affected Organization:** CrowdSec
- **Sector:** Cybersecurity / Software Development
- **Geography:** France / Global
## Timeline of Events
### Initial Access
- **Date/Time:** May 11, 2026
- **Vector:** Supply Chain Attack (npm)
- **Details:** 84 malicious versions of 42 TanStack npm packages (CVE-2026-45321) were published to the npm registry. A developer (who was in the process of offboarding) had a compromised laptop that executed the malicious code, leading to credential theft.
### Lateral Movement
- **Details:** The attacker utilized stolen GitHub OAuth tokens from the compromised machine to gain authenticated access to CrowdSec’s private GitHub organization.
### Data Exfiltration/Impact
- **Date/Time:** May 22, 2026
- **Details:** Approximately 170 private repositories were copied. The content included the web console, data science models, automation scripts, and the proprietary consensus algorithm. PII for 83 users and 51 potential investors was also compromised.
### Detection & Response
- **Detection:** September 16, 2026, when the source code appeared on an online forum.
- **Response:** CrowdSec rotated exposed credentials on September 16–17, 2026, and engaged GitHub support to trace the historical usage of the (now expired) OAuth token.
## Attack Methodology
- **Initial Access:** Supply chain compromise via malicious npm packages (CVE-2026-45321).
- **Persistence:** Not explicitly maintained; the attacker relied on the validity of a long-lived OAuth token.
- **Privilege Escalation:** Use of legitimate administrative/developer credentials.
- **Defense Evasion:** Use of legitimate OAuth tokens which did not trigger immediate security alerts in AWS; activity was masked as legitimate developer work.
- **Credential Access:** Automated theft of GitHub tokens and SSH keys from the local developer environment.
- **Discovery:** Reconnaissance of GitHub repositories once access was gained.
- **Lateral Movement:** N/A (Direct access to GitHub environment).
- **Collection:** Bulk cloning/copying of 170 private repositories.
- **Exfiltration:** Cloud-to-External transfer of repository data.
- **Impact:** Unauthorized disclosure of intellectual property and PII.
## Impact Assessment
- **Financial:** Potential loss of competitive advantage regarding the proprietary consensus algorithm; costs related to incident response and notification.
- **Data Breach:** 170 private repositories; 83 user emails; 51 investor profiles (names, emails, investment context).
- **Operational:** Low; no infrastructure or production databases were compromised, and no code was altered.
- **Reputational:** Public apology issued by CEO; potential impact on trust regarding offboarding procedures.
## Indicators of Compromise
- **Network indicators:** N/A (Traffic appeared as legitimate GitHub API/Web traffic).
- **File indicators:** Malicious TanStack npm packages (CVE-2026-45321).
- **Behavioral indicators:** Unusual repository cloning volume from a single user account; unauthorized use of AWS SNS credentials on August 17.
## Response Actions
- **Containment:** Offboarded the former employee’s GitHub access (completed May 25, though after the exfiltration).
- **Eradication:** Rotation of all potentially exposed secrets and AWS SNS credentials on September 16-17.
- **Recovery:** Notified affected users and investors; reported the breach to relevant authorities.
## Lessons Learned
- **Offboarding Gaps:** Delays in removing third-party access (GitHub) for departing employees created a window of opportunity for the attacker.
- **Supply Chain Risk:** Reliance on common npm packages without adequate auditing or endpoint protection allowed malicious code to execute on developer machines.
- **Logging Limitations:** Standard GitHub logs did not provide sufficient visibility into the OAuth token usage until escalated to GitHub support.
## Recommendations
- **Zero-Tolerance Offboarding:** Implement automated workflows to revoke all access (SaaS, Cloud, Git) immediately upon an employee’s departure.
- **Endpoint Protection:** Mandate Endpoint Detection and Response (EDR) software on all developer machines to detect malicious script execution.
- **Secret Management:** Implement scanning for hardcoded secrets in repositories and use short-lived, scoped tokens wherever possible.
- **Dependency Auditing:** Utilize tools to lock and verify npm package versions and scan for known vulnerabilities (CVEs) in real-time.