One bad npm package, five months later, 170 repositories gone

CrowdSec has confirmed that roughly 170 of its private GitHub repositories were copied in May, and that it only found out about it on 16 September, when the stolen code turned up on a cybercrime forum. The French security company's account of how it happened is unusually blunt: the way in was a poisoned npm package, and the door it opened had been left unlocked by its own offboarding.

What CrowdSec has actually confirmed

The downloads ran for nine minutes, from 05:52:29 to 06:01:33 UTC on 22 May, from an IP address in Toronto, using a GitHub account belonging to a developer who had recently left the company but kept access to finish outstanding work. That access was not revoked until the afternoon of 25 May - three days after the code had already been taken. CrowdSec's statement says the private repositories hold the source code for its SaaS console, some AWS Cloud routines, connectors and automations, and that the "300 repositories" figure doing the rounds is accurate once the 130-odd public repositories are counted in, though the number mostly says something about how the code is split up rather than how much was taken. On the data question it is direct: no client data, logins, passwords, names or organisations were leaked, because CrowdSec says it stores no personal data or client logs. The Hacker News reports that the archive did include the email addresses of 83 CrowdSec users, less than 0.05% of its user base, and the names, email addresses and investment context of 51 potential investors from 2020. The account was used only to fetch code, and no source code or CI/CD pipeline was modified.

Where the npm package comes in

CrowdSec traces the thread back to 11 May, when 42 TanStack npm packages were backdoored across 84 malicious releases with credential-harvesting malware - the incident tracked as CVE-2026-45321. A compromised component was in use inside CrowdSec that month and appears to have been backdoored specifically to extract an API key with read authorisation over its private codebase, which is why the exposure was only live for a short window in May. On 17 August an AWS token used for SNS notifications was tested to see exactly what it was allowed to do. From the night of 16 September CrowdSec rotated credentials and tokens, brought GitHub in to reconstruct the token's history, published a statement on 17 September, a full timeline on 18 September, and notified the people affected. The company gives credit to Fuites Infos for reporting it rather than shopping it around.

Our opinion

The repository count is the least interesting number here. What matters is that a backdoor planted in a dependency in May was still holding a working key to a private codebase months later, because the account's access outlived the employment. Letting a departing colleague keep the keys "to finish a bit of work" is a decent, human instinct that quietly converts a five-month-old npm incident into a live credential, and it is a far more common arrangement than most security policies admit. CrowdSec's handling deserves credit too: same-week timestamps, an admission that the access was its own decision, and a section telling everyone that the scary headline number is technically true and practically meaningless. That is what incident disclosure should look like, and it is rarer than it should be. If you take one thing from it, make it the boring one - treat a former colleague's token as compromised until you have proven it is dead, and rotate on suspicion rather than on confirmation.