Around 170 private repositories walked out of a security company's GitHub organization in nine minutes on a Friday in May. Nobody saw it. Not the company, not GitHub. Word arrived 117 days later, from a criminal forum and a French site watching it.
Its homepage promises to know which IPs are attacking you.
It still promises that today.
The homepage promise
It says so up top: "We Know the IPs Attacking You — Do You?". Below it, the numbers: more than 250,000 active installations, more than 40 million signals a day, and seven to sixty days of lead over the rest of the market at populating its blocklists.
The model is good. Thousands of servers read their own logs, report what hits them, and a consensus decides which address makes it onto the shared list. None sees the whole attack; each sees a fragment. CrowdSec sells the sum: a business built on knowing who attacks you.
On September 16, at 17:45, someone posted an archive on a criminal forum holding more than 300 repositories from that organization — more than 130 already public by design. Fuites Infos, the French site that watches those forums, measured some 3.4 GB of non-public code and raised the alarm. By 20:00 there was a crisis cell.
Nine minutes on a Friday in May
What they found wasn't from September.
The forensic report dates the theft to the second: "May 22nd, 2026 – 05:52:29 until 06:01:33 UTC". Nine minutes — the subtraction is ours, both endpoints are theirs. Inside that window, around 170 private repositories were downloaded from an address in Toronto, on a machine set to UTC-4.
Out went the commercial console, AWS routines, connectors, data science work. And the consensus algorithm: how many witnesses the machine that declares an address guilty needs is now known.
That the copy is from May is proved by the archive itself: it holds a repository destroyed on May 27. The September claim sold the intrusion as fresh.
The door showed up when GitHub handed over the git activity for those two hours: the account of a developer who had just left and was still in the organization. The reason is in their own words: "We kept them alive because we parted on good terms with our developer, and he wanted to finalize some work." The Hacker News summed it up without anesthesia: "The French security company had kept his GitHub access open."
The account was used only to clone. No commit, no change to the code.
A token that was born, lived and died
The forensics were a gift from the thief. The archive carried the .git/config with the origin used to clone: url = https://oauth2:gho_xxxxxxxxx@github.com/crowdsecurity/.github.git. The gho_ prefix says OAuth, and the checksum adds up.
They went looking for it in their own audit log, and in every current member's. Nothing. "This was a dead end."
It wasn't carelessness. It's a price list: "GitHub's audit log only tracks specific actions, and only enterprise plans (which we're not on) keep git activity on a rolling 7-day window."
Read that slowly. The record that would have shown 170 repositories leaving through the front door in nine minutes exists, works, and is a bullet point on a pricier plan. The camera is installed. The recording is rented by the month. What does finding out cost?
The sentence that explains the 117 days is theirs too: "So it was created, lived, and died without leaving us any traces beyond its usage."
Where they did have eyes was AWS, and there the attempt left a trace: on August 17 someone tried a secret from the dump against a role that could only publish to one SNS topic. It went no further.
The only visibility that worked was guarding what wasn't taken.
Two versions in twenty-four hours
On September 17, the first statement pointed inward — a TanStack component used inside the organization, "backdoored to extract an API key with authorization to read the private codebase" — and was categorical about the rest: "No client data, login/password, name, organization, or anything else was leaked."
At 18:00 that same day, GitHub handed them the token's full lifecycle. The September 18 report rewrites the account: no malicious package in their repositories — though the review, they admit, "was inconclusive" — an OAuth token from the former employee's account, and the infected machine outside the company. And personal data did leak: 83 user email addresses, plus the names, emails and investment context of 51 potential investors from 2020. Fuites Infos added it up for its headline: 134 people exposed. The report's only personal apology goes to the investors: "for this I personally apologize."
This is not the press catching a company out. It is a company correcting itself in twenty-four hours, with information only GitHub had. What survives both versions is the TanStack link, and CrowdSec doesn't prove it, it inherits it: "They traced the token's full lifecycle and confirmed our initial suspicions about TanStack." Nobody said which package reached the laptop, or when. And neither text asks users to do anything.
The link upstream
On May 11, someone published 84 malicious versions across 42 @tanstack/* packages (CVE-2026-45321, CVSS 9.6) without stealing a single npm credential: the worm pulled the OIDC token out of the build process's memory and published with legitimate identity and valid SLSA Build Level 3 provenance attestations. Orca says it plainly: "provenance alone is not a reliable safety signal" — the same lesson we already paid for with the keyv worm. What does a signature like that certify?
That wave also took Mistral AI's SDKs and two OpenAI employee devices, and on PyPI guardrails-ai. The worm persists in .claude/ and signs its dead-drop commits as claude@users.noreply.github.com.
Back in March we mapped that same group around one thesis: the industry that sells supply chain security cannot protect its own. We wrote there that some organizations don't even know they were compromised. CrowdSec was one of them for 117 days: May 22 to September 16.
And closing litellm-paila we said the next attack would "live in your cluster for three months before someone asks the right question". We undershot it: here nobody asked the question. The answer showed up by itself, from a forum.
The controls they did have
The report lists what they already had before the incident: strict privilege separation, two-factor with physical keys, npm package age monitoring. And one more bullet, about the credentials of whoever leaves: "removing (or knowing why you kept) all access once they are gone matters even more."
They wrote that. In the list of what they already did. In the report about an account they left open. How many are still alive today for the same reason?
They went PAILA for parting on good terms.
Then the honest question in the text itself: "Yet, all of this couldn't prevent a Supply Chain Attack, so what could have?". The answer — endpoint protection on developer machines — arrives with its own hole: "because the employee had already left the company, the likelihood that he still had endpoint protection on his machine was low."
The remedy doesn't reach the laptop that caused the incident. They no longer controlled that laptop.
The damage ledger celebrates the "prompt revocation of the departed employee's core access": the one from May 25, three days after the nine minutes. The 48-hour response the report credits itself with is counted from September 16; from May 22, the clock reads 117 days. The homepage, meanwhile, still promises seven to sixty days of lead. Different measures, same brochure.
The chief executive didn't hide it either: he reproduced in his report the mockery he got, "They claim to know who attacks us but cannot avoid them attacking themselves". The same idea was going around on Hacker News.
Attribution
Perpetrator: CrowdSec names it by alias and marks the limit of its own claim: "one of the founders of BreachForum and a member, diencracked ... At least that's what the Git data shows." Upstream sits TeamPCP, which on that same May 22 claimed the hack of Mistral AI repositories.
Accomplices: courtesy. An account kept alive because they parted on good terms and work was left to finish: a reasonable decision, by reasonable people, that left a master key hanging in the door. And an industry that still reads a valid attestation as a safety signal.
Systemic failure: GitHub's visibility model. Git activity is kept for seven days, and only for whoever pays for the Enterprise plan. Below that line, cloning an entire private organization leaves no record its owner can read. It isn't a flaw: it's the product. The strange part isn't that it happened to CrowdSec — it's how many could even find out.
CrowdSec searched its audit log for the token and found nothing. What was missing sat in the archive somebody uploaded to a criminal forum: the URL with the token, and the hour it needed to ask GitHub for the rest. The logbook of those nine minutes was written by the thief, and it took 117 days to reach the victim.
How many companies believe today that nothing happened to them, when the only thing missing is for somebody to decide to publish the archive?