The source left in May

CrowdSec is a security company. The code still left.

SecurityWeek has them confirming today that roughly 300 GitHub repositories — about 170 private — were copied in May. Private tree includes the SaaS console, some AWS routines, connectors, automations. They say no customer credentials rode along, and that they rotated tokens in the May window. They learned the theft last week.

The assessed door is the TanStack supply-chain attack: TeamPCP published 84 malicious artifacts across 42 packages. CrowdSec had one of those packages on a machine that could reach GitHub. The malware is assessed to have taken an API key that could read the private codebase. Short exploitation window. Four months of not knowing.

The gap is not the npm install

It is the clock between “we used a popular library” and “someone listed our private repos.” File integrity on the SaaS origin does not tell you a CI token was used to clone. Customer-data scans do not tell you the console source is sitting in someone else’s bucket. CrowdSec’s line is that leaked code without their data and tools cannot be replayed. That is a claim about this dump. It is not a process.

If you ship product from GitHub, the question for counsel is not “did npm get owned in May.” It is whether you have a record of which tokens that machine held, which private repos those tokens could read, and whether anyone has been quietly pulling them since. Four months is a lot of pull requests.

What to do with a delayed source theft

Treat the May token as live until GitHub says it is dead in their logs, not yours. Rotate the rest of the family, not the one key you already burned. Assume copies of private code are out of your incident channel. Watch for lookalike packages, lookalike SaaS consoles, and support mail that knows your internal names.

A crowdsourced IDS vendor finding its own source on a delay is not irony. It is the normal shape of a developer-endpoint steal. The package was the lure. The GitHub key was the breach. September is when they noticed.