CrowdSec Ties Code Theft to TanStack Flaw

CrowdSec has disclosed that source code was taken from its GitHub repositories, an exposure the company connects to a supply chain attack that played out months earlier. The French cybersecurity firm, which provides open source crowdsourced threat intelligence, said the impact is confined to its own organization.

The disclosure offers a concrete look at how a compromised dependency can lead to a much later reckoning, even when the initial intrusion window is short.

What CrowdSec says was taken

CrowdSec has confirmed that approximately 300 private and public repositories were compromised and that source code was stolen from them. The company said roughly 170 of the affected repositories were private.

In a statement, CrowdSec described what the private portion contained: “The private part contains the source code for our SaaS console, some AWS Cloud routines, some connectors, and automations.”

CrowdSec also said no credentials or other customer-related data were leaked, and that the impact is limited to its own organization.

No evidence of lateral movement, per the company

CrowdSec said it moved quickly to look for any token, credential, or sensitive leak that could support lateral movement. “Our team quickly hunted for any token, credential, or sensitive leak that could enable lateral movement but found none so far,” it said.

The company added that the stolen private code, while valuable, cannot be used to cause harm on its own because it cannot replicate CrowdSec's network and depends on its data and tools. As a result, CrowdSec said, the code cannot be used out of context.

CrowdSec also addressed the SaaS source code specifically: “We regularly audited the SaaS source code, and its leakage shouldn't pose an immediate threat either. Most of the leaked code has evolved significantly over those four months, but we will closely monitor for any abnormal activity.”

How the breach unfolded

CrowdSec said it learned last week that source code had been taken from its GitHub repositories in May 2026. The company believes the theft was likely a direct result of the May 2026 TanStack supply chain attack, in which TeamPCP published 84 malicious artifacts across 42 TanStack packages.

CrowdSec used a TanStack package in May. According to the company, the malware used in that campaign likely compromised an API key that allowed the attackers to read its private codebase.

The leak likely occurred in May, during the short exploitation window, and CrowdSec said it immediately rotated all potentially affected tokens and credentials.

The backdrop: a wider supply chain campaign

The TanStack incident is one of several supply chain attacks reported in recent months. Related coverage includes the Brevo supply chain attack, which injected malware into 100,000 websites, and a Rust supply chain attack linked to North Korean hackers.

Other recent incidents include a Revolut data breach that affected 680 high-profile accounts over five months with a $3 million ransom demand, and a Gyazo data breach that compromised 23 million user records.

CrowdSec's disclosure adds a source code exposure to that list, and its account ties the theft to a dependency that was compromised months before the company confirmed what happened.

What the numbers show

CrowdSec's statement includes a set of figures that describe both the footprint inside its GitHub organization and the scale of the campaign it points to as the origin:

• Approximately 300 private and public repositories compromised
• Approximately 170 of those repositories were private
• 84 malicious artifacts published across 42 TanStack packages
• Source code stolen in May 2026

Why the timing matters

CrowdSec says it became aware of the theft last week, even though the data was taken in May 2026. The company's statement notes that most of the leaked code has evolved significantly over those four months, meaning some of what was taken may no longer reflect current systems.

That gap between the May 2026 theft and the company's confirmation is central to the incident's timeline. CrowdSec also said it immediately rotated all potentially affected tokens and credentials after learning of the theft.

The company said the exposure was likely a direct result of the TanStack supply chain attack, and that the malware likely compromised an API key that gave attackers read access to its private codebase.

What CrowdSec is telling customers

CrowdSec's statement is direct about scope: no customer credentials or customer data were leaked, and the impact is limited to its own organization.

The company has not said the stolen code is worthless. Instead, it argues that the code cannot cause harm on its own because it depends on CrowdSec's network, data, and tools, and therefore cannot be used out of context. CrowdSec also said it will closely monitor for any abnormal activity.

“The private part contains the source code for our SaaS console, some AWS Cloud routines, some connectors, and automations.”

— CrowdSec, in its statement on the source code exposure

What the incident means for defenders

The CrowdSec case is a reminder that supply chain compromises can surface at a different company long after the initial attack. The company's own account shows how a package used once in May can be linked to a code theft confirmed months later.

For security teams, the practical takeaway is that dependency hygiene and credential hygiene are intertwined. The company's response — rotating tokens, hunting for lateral movement, and monitoring for abnormal activity — reflects the steps it says it took after learning of the theft.

The timing also highlights a difficulty for defenders: an exploitation window can be short, but the consequences may not be visible until much later. CrowdSec's disclosure suggests that organizations relying on open source components should assume that a compromised dependency can reach further than the initial alert implies.

For CrowdSec's users, the company's characterization is the basis for judging the event. CrowdSec says no customer credentials or customer data were leaked, and that the stolen code cannot be used out of context. It also says it will keep monitoring, an acknowledgment that the picture could change.

The broader implication is that source code exposures force organizations to weigh what was taken and what it can enable. CrowdSec's account is narrow: the impact is limited to its own organization, no customer credentials or customer data were leaked, and the stolen code cannot be used out of context because it depends on CrowdSec's network, data, and tools.

Those are the company's claims about its own incident, and they rest on its own investigation. CrowdSec says it will keep monitoring for abnormal activity, which is a reasonable posture for an incident whose exploitation window closed months before anyone confirmed what happened.