CrowdSec statement (17 September 2026; informed 16 Sep) confirms a May 2026 leak of its private GitHub repositories (SaaS console, AWS cloud routines, connectors, automations). Public Security Engine repos are out of scope by design.

CrowdSec says reports of ~300 repositories are accurate when 130+ intentionally public repos are included, and that the figure reflects code subdivision rather than 300 separate sensitive systems. Company assessment: TanStack npm supply-chain compromise (CVE-2026-45321; TanStack postmortem 11 May 2026 — 84 malicious versions across 42 @tanstack/* packages) is the very likely vector, similar to Mistral AI’s related case; a backdoored component appears to have extracted a CI/CD API key with read access to the private codebase during a short May window.

CrowdSec says no client data, login/password, name, organisation, or PII/client logs were leaked; hunting for lateral-movement credentials found none so far; tokens/credentials rotated after confirmation. Thanks Fuites Infos for disclosure. (sources: CrowdSec; TanStack postmortem for CVE-2026-45321)

Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: CrowdSec; TanStack)