CrowdSec GitHub Repositories Stolen in Supply Chain Attack

Threat actors have stolen approximately 170 private GitHub repositories from the French cybersecurity firm CrowdSec. The breach was facilitated by a supply chain attack targeting the TanStack npm package and the use of the Shai-Hulud worm.

The incident occurred on 22 May 2026. During a nine-minute window between 05:52 and 06:01 UTC, attackers used a stolen GitHub API token to download the contents of various repositories.

Discovery and Impact

CrowdSec discovered the breach on 16 September 2026, after a user published an archive containing the company’s source code on pwnforum, an underground cybercrime marketplace. Following the disclosure, CrowdSec CEO Philippe Humeau confirmed that the leak is limited to source code, including over 130 public repositories and numerous private ones.

Humeau stated that none of the company’s infrastructure or databases were accessed or compromised. Furthermore, investigations indicated that the attackers did not alter any source code within the open-source software, private repositories, or build pipelines.

Security Gaps and Remediation

The investigation traced the unauthorised access to a former developer’s account. Although the individual had left the company, their GitHub account remained part of the CrowdSec organisation to allow for the completion of outstanding work. The developer’s computer had been compromised via the TanStack supply chain attack, allowing attackers to steal a GitHub OAuth token with permissions to read the company’s private repositories.

Security experts noted that the incident highlights the risks of lingering access. Denis Calderone, co-founder of Suzu Labs, remarked that revoking access immediately upon an employee’s departure is a fundamental security requirement.

CrowdSec acknowledged that the company did not have endpoint detection and response (EDR) enforced on developer machines at the time of the attack. In response to the incident, the firm has implemented endpoint protection specifically designed to monitor for malicious packages and extensions.

The company removed the former employee’s GitHub account on 25 May 2026, three days after the initial theft.