CrowdSec private repositories copied with a departing engineer's GitHub token
CrowdSec said on September 17, 2026 that source code had been exposed, first linking it to the May 11 TanStack npm attack. Its September 18 report instead traced the copy to a former employee's GitHub account, left open so he could finish some work, whose still-valid OAuth token was used on May 22 to copy about 170 private repositories. The account was removed from the organization on May 25 and the code appeared on a forum in September; the two statements disagree on whether user and investor data leaked.
- Victim
- CrowdSec
- Industry
- Technology
- Country
- France
- Intrusion began
- May 22, 2026
- First disclosed
- Sep 17, 2026
- Actor
- Unattributed
- Initial access
- OAuth token abuse
- Identity control that failed
- Identity lifecycle
- MFA
- Not applicable (no interactive login)
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
Access kept open for a leaver, through a token that bypasses MFA, did the damage. Offboarding should revoke OAuth tokens and organization membership on the last day, with exceptions time-boxed and monitored.
Go deeper on SWI
- Technique: Orphaned account abuse
- SWI coverage: crowdsec kept a departing engineers github access open and lost 170 repos
Sources
- CrowdSec Statement: Source Code Exposure in May 2026, CrowdSec, Sep 17, 2026
- TanStack Supply Chain Attack Analysis, CrowdSec, Sep 18, 2026
- CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories, The Hacker News, Sep 19, 2026
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Midnight Blizzard password spray into Microsoft corporate email 2024 · Password spraying
- GitHub private repositories accessed with stolen Heroku and Travis CI OAuth tokens 2022 · OAuth token abuse
- Malwarebytes email access via abused Microsoft 365 application 2021 · OAuth token abuse
- Gainsight-published Salesforce app tokens abused against customer instances 2025 · OAuth token abuse
Cite this record
SWI Community Team. (2026). CrowdSec private repositories copied with a departing engineer's GitHub token. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2026-crowdsec-departing-engineer-github-token/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.