Summary
- CrowdSec says roughly 170 private GitHub repositories were copied on 22 May using a former employee's OAuth token.
- GitHub-assisted investigation linked the token compromise to May's TanStack supply chain attack.
- CrowdSec says its infrastructure, databases, CI pipelines, and software code were not modified, but some limited personal data and source material were exposed.
French cybersecurity company CrowdSec says a credential compromised through May’s TanStack software supply chain attack was used to copy around 170 private GitHub repositories, illustrating how a compromised developer dependency can remain consequential long after the original malicious package has disappeared.
CrowdSec published its final incident analysis on 18 September after source code from the company appeared on a hacking forum two days earlier. Its investigation concluded that the repositories had actually been copied on 22 May, almost four months before the leak became public.
The company said an OAuth token belonging to an employee who had just left CrowdSec was used to perform the Git clones. The account had temporarily remained inside the company’s GitHub organisation so the former employee could complete outstanding work, while other access had already been revoked.
GitHub subsequently helped CrowdSec trace the token’s lifecycle. CrowdSec said that evidence aligned the compromise with the TanStack supply chain incident, in which malicious versions of packages were distributed in May as part of a wider credential-harvesting campaign.
The distinction between code exposure and infrastructure compromise is important. CrowdSec said its production infrastructure and databases were not accessed, its build pipelines were not altered, and no commits or modifications were made to either public or private code. The compromised account was used to clone repositories, according to the company’s investigation.
The copied material nevertheless included private source code and some sensitive information. CrowdSec said most credentials contained in repositories had already been rotated or were unusable from the internet. One live AWS credential was restricted to publishing notifications through a single SNS topic and was later probed, but the company said that attempt did not progress into wider AWS access.
CrowdSec also identified limited personal data in the leaked material. It said 83 user email addresses used by its data science team were present, along with names, email addresses, and investment context relating to 51 potential investors from 2020. The company said it would contact affected people and relevant authorities.
The timeline exposes a common gap in supply chain incident response. Organisations may rapidly remove a malicious package and rotate credentials they know were affected, yet secondary credentials already harvested during the compromise can remain useful if they belong to accounts whose business purpose has not fully ended.
Employee offboarding becomes particularly relevant in developer environments because GitHub, cloud services, package registries, CI platforms, and signing systems frequently use different identities and tokens. CrowdSec had revoked the former employee’s other access, which it says prevented movement into AWS and infrastructure, but GitHub access remained for a legitimate business reason.
The incident also shows why repository count alone is an imperfect measure of impact. Around 170 private repositories were copied, but CrowdSec said many related to code organisation and interface assets and had little standalone operational value. What mattered more was whether source repositories contained reusable secrets, customer data, proprietary logic, or pathways into deployment systems.
In this case, privilege separation limited the consequence. The account that exposed the code did not provide equivalent access to the company’s infrastructure, and CrowdSec said its central security network and customer environments were not compromised through the incident.
The disclosure nevertheless provides a concrete downstream example of the persistence of software supply chain compromise. An attack on one development dependency became a credential theft event, the stolen credential remained usable in another organisation, and the resulting data copy was not discovered until months later when the material was publicly released.
