A Security Company's Private Code Sat Stolen for 117 Days

20 SEP 2026 — CrowdSec sells security software. On 22 May, someone copied about 170 of its private GitHub repositories. The company found out on 16 September, when the code appeared on a criminal forum. Nothing in between detected it. That is not an irony to dwell on, but it says something about what this class of theft looks like from the inside.

How the token was obtained

The route in was the TanStack compromise. On 11 May, attackers published 84 malicious versions of 42 TanStack npm packages, tracked as CVE-2026-45321. Installing one of them ran code that harvested credentials from the developer's machine: GitHub tokens, SSH keys, cloud credentials.

One of those machines belonged to a CrowdSec employee. The company's analysis says GitHub support traced the token back to an account owned by an employee who had just left but still sat in the GitHub organisation for legitimate reasons. That account was used to dump the repositories.

That is the control failure. A departed employee retaining organisation membership is a routine arrangement with a routine justification, but it converted one compromised laptop into access to everything.

What was in the archive

Around 170 private repositories, alongside more than 130 public ones. The private material included the SaaS console, data-science scripts and models, deployment and automation tooling, and the consensus algorithm that decides which IP addresses reach CrowdSec's blocklists.

The archive held two categories of personal data. One was email addresses: 83 of them, which CrowdSec puts at under 0.05 per cent of roughly 150,000 users and describes as mostly Gmail addresses used by its data-science team for monitoring. The other was 51 potential investors from 2020, with their email addresses and investment context.

The company says the leak held no client or partner information except those few data-science addresses. Reporting that as "user emails leaked" gets the shape wrong. These were internal monitoring addresses, not account holders.

The gap that matters

CrowdSec revoked the account's access on 25 May, three days after the repositories were taken. That was not a response to the theft, because nobody knew about it; it was ordinary offboarding catching up.

So the timeline runs like this. The code was copied on 22 May. Access closed on 25 May for unrelated reasons. Then came 114 further days in which the company had no idea its source code was in someone else's hands. Discovery arrived at 17:45 on 16 September, when the material surfaced publicly. The first statement followed at noon the next day.

An organisation cannot detect a read it has no record of. A valid token used by a legitimate account to clone repositories that account may clone generates no anomaly worth an alert. This is the gap in supply-chain monitoring.

What was not touched

CrowdSec is specific about what did not happen, and the limits matter. Its infrastructure and databases were not accessed or compromised. No code was altered in the open-source software, the private source, or the build pipelines.

That last clause is the one that would have made this an emergency rather than an embarrassment. A supply-chain attacker with write access to a security vendor's build pipeline is a different story entirely. This was a read.

The stolen consensus algorithm is the item with the longest tail. Knowing how a blocklist decides what to block is permanently useful to anyone who would rather not be blocked.