The contents of about 170 of CrowdSec’s private GitHub repositories appeared in a breach-forum post on 16 September. That post is how CrowdSec learned about the leak. The downloads it presented had happened almost four months earlier, on 22 May, inside a nine-minute window. The company published its full account on the 18th, and it reads better than most incident reports because of how plainly it says which door was open, and why.
The way in
The chain starts with the TanStack npm compromise on 11 May: 84 malicious versions across 42 packages, carrying credential-harvesting malware. One of the machines the malware touched belonged to a CrowdSec developer who had recently left the company, and his GitHub access was still live. That part was deliberate. CrowdSec kept it because, in their words, “we parted on good terms with our developer, and he wanted to finalize some work.”
On 22 May, between 05:52:29 and 06:01:33 UTC, the contents of the roughly 170 repositories were downloaded, from an IP address in Toronto on a machine whose clock ran on UTC-4. CrowdSec attributes the download to a person it describes as one of BreachForum’s founders, operating under the handle diencracked. The access was revoked on 25 May, three days after the copy.
Then came the quiet. On 17 August, someone tested what an AWS token used for SNS notifications was authorized to do. CrowdSec would not know about that for another month, either. What ended the quiet, on 16 September at 17:45, was the forum post itself.
What actually leaked
CrowdSec spends most of the write-up putting the haul in perspective, starting with the number everyone quoted. The repository count is, in their words, “relatively irrelevant”; it says more about how the codebase is organized than about what was exposed. The web console code contains no secrets. The data-science scripts and models are worth little without the data that trains and feeds them. The blocklist consensus algorithm was already publicly described at the architecture level, though the thresholds are now known, which they concede matters, and then note they can move the thresholds when needed.
The credentials came out close to clean: one live token, scoped to AWS SNS notifications and little beyond them, with a few others already rotated or unusable from the internet. The personal data is small and specific, 83 email addresses, under 0.05% of roughly 150,000 users, plus the names of 51 potential investors from 2020, and the users involved will be told. The fact CrowdSec keeps returning to is the real one: someone they never authorized had a private codebase in hand.
My read
Every organization keeps an access alive for a departing colleague eventually, usually for decent reasons, and mostly without looking at it again. This is that arrangement meeting the wrong laptop at the wrong moment. The malware landed on 11 May, the copy happened on the 22nd, and neither event made a sound for four months. The lesson is not exotic — offboarding ends in revocation, or it was not offboarding — but the honesty on display is. “Being caught leaking code is painful,” the post says, and then it spends its remaining length answering the questions anyway, including the one where GitHub’s investigation recovers what the company’s own logs could not.
The report is worth reading in full. It sets the standard the next company in this position will be measured against.
Sources: CrowdSec’s incident analysis and TanStack’s postmortem