CrowdSec, the French security vendor behind a widely used crowdsourced IP reputation network, disclosed on September 18 that an attacker copied roughly 170 of its private GitHub repositories back in May, four months before anyone noticed. The company traces the theft to May’s supply chain attack on TanStack’s npm packages: a departed employee’s laptop had been infected by one of the malicious package versions before he left, and his GitHub credentials, still active for offboarding work, were used to clone the repositories between May 22 and 25. The stolen code surfaced on a cybercrime forum on September 16, triggering CrowdSec’s investigation and disclosure.
Why it matters: the repositories included CrowdSec’s SaaS console code, its data-science models, deployment tooling and the consensus algorithm it uses to decide which IP addresses join its shared blocklist, core logic many downstream customers implicitly trust. The theft also exposed 83 CrowdSec users’ email addresses and the names, emails and investment details of 51 potential investors from a 2020 fundraising round. CrowdSec says infrastructure, databases and CI/CD pipelines were not accessed and no code was altered, only copied.
The original insight is what this incident says about offboarding as a security control, not an HR formality. The four-month gap between the theft and its discovery did not come from a sophisticated evasion technique, it came from a standard credential-hygiene failure: access that should have ended with employment instead persisted long enough for a device compromised elsewhere to become the entry point. That is a distinct failure mode from the credential-scanning npm worm variant this site covered days earlier, and a reminder that the same npm supply chain wave keeps producing second-order breaches long after the malicious packages are pulled.
Security teams should treat any device known to have run a compromised package as suspect even after the package is removed, revoke rather than deactivate departing employees’ GitHub and CI credentials on their last day, and alert on repository clone volume from a single account, since 170 repositories cloned in a short window is exactly the anomaly a basic audit-log rule would catch.
Source: CrowdSec
