The cybersecurity company said its investigation, completed with assistance from GitHub, traced the breach to an OAuth token obtained after the employee’s account was compromised in the May TanStack attack. The repositories were downloaded on May 22, between 05:52 and 06:01 UTC, from an IP address in Toronto, according to CrowdSec’s forensic review.
CrowdSec said the copied material included private source code alongside more than 130 repositories that were already public. It said there was no evidence that its production infrastructure, databases or build pipelines were accessed, and no code was altered.
The company was alerted to the source-code exposure on September 16 after an archive was published on an online forum. It then assembled an incident-response team, began forensic work and rotated remaining credentials and tokens before publishing an initial statement the following day. A fuller technical analysis was issued on September 18.
CrowdSec said GitHub support reconstructed the lifecycle of the OAuth token used for the cloning activity and linked the access to an employee who had just left the company but whose GitHub organisation membership had remained active temporarily to allow unfinished work to be completed. The account was removed from the organisation on May 25.
The company connected that compromise to the TanStack npm incident disclosed in May. TanStack said attackers exploited a GitHub Actions configuration weakness, poisoned shared workflow caches and extracted a publishing token from runner memory. That chain allowed 84 malicious versions across 42 packages in the TanStack Router and Start repository to be published to npm on May 11.
The affected packages carried credential-stealing malware capable of harvesting GitHub tokens, npm credentials, cloud-service secrets, Kubernetes and Vault tokens and SSH private keys. TanStack said the malicious versions were deprecated within hours and subsequently removed from the npm registry. It advised users who installed affected versions during the exposure window to treat those environments as compromised and rotate accessible credentials.
CrowdSec said the employee’s account was used only to clone repositories. Its audit found no commits, code changes or modifications to continuous-integration systems. The company also said the employee’s access to core infrastructure had already been revoked, which it cited as a reason no suspicious activity was found in its cloud environment.
One live AWS credential appeared in the leaked code, CrowdSec said. The token was restricted to publishing notifications through a single Simple Notification Service topic. The company said someone tested the credential on August 17 using identity and topic-listing calls, but it found no evidence of broader access.
The leaked code also contained data-science scripts, models, automation tools and internal console source code. CrowdSec said these materials did not include customer databases or operational infrastructure credentials. It acknowledged that disclosure of source code could still give attackers added visibility into internal logic and said it would continue monitoring for abuse.
Some personal information was also exposed. CrowdSec said 83 email addresses used by its data-science team for project monitoring and statistical work were present in the material, representing less than 0.05 per cent of roughly 150,000 users. It also said names, email addresses and investment-related context concerning 51 potential investors from 2020 were included.
CrowdSec said it would contact the affected individuals and make required notifications to relevant authorities. It added that most secrets identified in the archive had already been rotated or were unusable from the internet by the time the leak became public.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
