An ex-employee's live OAuth token let strangers copy 170 CrowdSec repositories in nine minutes

Most offboarding checklists end at the identity provider. CrowdSec's former employee had left the company but stayed inside the GitHub organization for what chief executive Philippe Humeau described as legitimate reasons, and his account "was used to dump the repositories," Humeau wrote ^[22]. The OAuth token on his laptop still had read permission on the private repositories ^[4].

TeamPCP claimed the TanStack attack on May 22, 11 days after it happened, so the compromise falls around May 11 ^[5][6]. The download ran the same day the group went public ^[7]. CrowdSec cut the laptop's GitHub access three days after that, about May 25 ^[8][9]. Between the download and the pwnforum listing sit 117 days ^[11]. The nine-minute session moved roughly 170 private repositories, about 19 a minute, and around 300 CrowdSec repositories public and private were caught in the campaign overall ^[12][3].

Humeau listed the controls already in place: privilege separation, two-factor authentication, audits, logs, penetration testing, automated code analysis, and age monitoring for npm nodes ^[23]. A list like that looks like coverage. Developer machines had no endpoint detection and response, which the company has since deployed with malicious packages and extensions as the focus ^[24]. "As supply chain attacks become the new plague and virtually anyone can get caught in them, we should have done this earlier," he wrote ^[25].

"we were very close to clean," Humeau wrote ^[14]. The leaked material included a token for Amazon's Simple Notification Service ^[15]. By his account the infrastructure is AWS serverless with heavy use of SSM and Secrets Manager, "so the number of credentials present is very low but still warrants analysis" ^[16]. "Most of the tokens and secrets present in the source code had been revoked or rotated before the leak, but we can see that the ones present and usable have been probed," he wrote ^[17].

CrowdSec's researchers wrote that "no client data, login/password, name, organization, or anything else was leaked, and CrowdSec doesn't store PII or client logs; the impact is limited to CrowdSec" ^[13]. The same disclosure counts the email addresses of 83 users, mostly Gmail ^[18], plus the first and last names, email addresses and investment context of 51 potential investors dating back to 2020 ^[19]. Against the company's 150,000 users, 83 works out to 0.055% ^[20]. Those two lists hold 134 named people ^[29].

In a study by the job search platform Zippia, 76% of IT leaders surveyed strongly agreed that offboarding represents a significant security threat ^[26]. The narrower version of that question fits in two columns: for each person who left in the last quarter, the tokens their machine held, and the alert that fires when one of those tokens is used. CrowdSec's researchers could not fill in the first column unaided. They had trouble tracing the stolen token and needed GitHub support staff to place it on the former employee's laptop ^[21].