CrowdSec says a poisoned TanStack package exposed its private source code

Why it matters

The leak reached the commercial code surrounding CrowdSec's open-source engine and was disclosed four months after the suspected access, testing the CI/CD controls behind its security pitch.

CrowdSec, the collaborative security business led by Philippe Humeau (@philippe_humeau), disclosed on September 17th that an intruder accessed private GitHub repositories during a short window in May. CrowdSec learned of the exposure on September 16th, leaving roughly four months between the suspected access and an outside researcher bringing it to CrowdSec's attention.

The repositories contained source code for CrowdSec's SaaS console, AWS cloud routines, connectors and automations. CrowdSec says its public Security Engine was outside the scope of the incident because that code is already open by design. CrowdSec also says no customer data, passwords, names, organizations, personally identifiable information or client logs were exposed. Its search for credentials that could support lateral movement found none so far, according to the disclosure.

Humeau founded CrowdSec in 2019 after spending most of his career on the defensive side of internet infrastructure. An EPITA-trained security engineer, he started the penetration-testing and high-security-hosting provider NBS System in 1999 and sold it in 2016. CrowdSec brought him back to an idea he developed with co-founder and CTO Thibault Koechlin while protecting hosting customers: defenders could share attacker IP addresses and make each installation stronger as the network grew.

CrowdSec traces that idea to an attack against an e-commerce customer that used more than 3,000 IP addresses. Humeau and Koechlin envisioned a Waze-like security network in which local software detects abusive behavior and contributes attacker intelligence to the wider community. Laurent Soubrevilla, CrowdSec's COO, joined them as the third co-founder.

That architecture shapes the stakes of the leak. CrowdSec gives away the detection engine while selling services around centralized management, integrations and threat intelligence. The exposed repositories sat on the commercial side of that boundary.

A May intrusion surfaced in September

CrowdSec says reports of roughly 300 affected repositories are numerically accurate when more than 130 intentionally public repositories are included. Its public GitHub organization listed 132 repositories on September 17th. CrowdSec argues that the larger figure reflects how its code is divided across repositories rather than 300 separate sensitive systems.

The suspected entry point was a compromised TanStack component used inside CrowdSec during May. CrowdSec believes the backdoored dependency extracted an API key belonging to a CI/CD component and that the key could read its private codebase. CrowdSec rotated the relevant tokens and credentials after confirming the report.

That attribution fits a documented software supply-chain attack from the same period. In a May 11th postmortem, TanStack said an attacker published 84 malicious versions across 42 packages during a six-minute window by exploiting GitHub Actions and extracting a token from a runner process. TanStack deprecated the affected releases and issued an all-clear on May 15th.

Mistral's security advisory separately described compromised npm and Python SDK releases tied to the TanStack incident. Mistral found that the malicious Python package harvested credentials from common locations on Linux systems. Its investigation identified an affected developer device and no impact on Mistral's global infrastructure.

Those records establish a broader campaign aimed at developer machines, build pipelines and their credentials. They do not independently verify CrowdSec's specific access path. CrowdSec's TanStack attribution remains its own assessment of the evidence.

The key question is what the stolen token could reach

CrowdSec says the API credential authorized reading of private repositories and describes the exposure as limited to its own code. A repository-reading credential can still be valuable because source trees may contain configuration details, internal service relationships and clues about deployment practices even when secrets are properly kept elsewhere.

CrowdSec says it searched the affected material for tokens, credentials and other sensitive information and found nothing that could enable further movement. It also says much of the exposed code changed during the four months before notification and that the private software depends on CrowdSec's own data and infrastructure, limiting its usefulness outside CrowdSec.

Humeau's argument that source code alone cannot reproduce CrowdSec's product follows the model he has promoted from the beginning. In a 2024 explanation of CrowdSec's open-source model, he wrote that CrowdSec gives away the engine in exchange for security signals, while reserving premium services for enterprise deployments. The accumulated intelligence network, rather than possession of the engine, supplies the commercial advantage.

Private code exposure still creates work for a cybersecurity provider. Attackers can inspect older implementations for mistakes, compare leaked versions against current deployments and search for assumptions that survived later revisions. CrowdSec says regular audits of the SaaS code and subsequent development reduce that risk, though the disclosure provides no independent technical assessment of the exposed commits.

Humeau's open-source bet meets its trust test

Investors financed CrowdSec around the premise that a free security engine could build a data network large enough to support paid products. Breega backed a $5M seed round in May 2021. CrowdSec followed with a Series A worth 14 million euros in October 2022, led by Supernova Invest with Breega participating.

The incident reaches the exact layer Humeau built to monetize that network: the SaaS console, cloud routines and integrations surrounding the public engine. His defense is commercially coherent. Copying code does not copy CrowdSec's contributors, incoming attack signals or installed base. It also leaves a narrower security issue for CrowdSec to answer through the controls around repository access and CI/CD credentials.

CrowdSec moved quickly once Fuites Infos reported the leak, confirming the exposure, rotating credentials and publishing its account within a day. The May-to-September gap is the harder operational lesson. A dependency running inside a trusted development process appears to have turned ordinary CI/CD access into a path across private code, and CrowdSec learned about it from outside its own systems.

For Humeau, the breach is a direct test of the collective-security thesis behind CrowdSec. The network may preserve the product's value after source code escapes. The security of that network still depends on mundane internal safeguards: tightly scoped build credentials, dependency controls and repository audit trails capable of detecting when trusted automation begins behaving like an intruder.