CrowdSec confirms its private source code leaked in May through a backdoored TanStack build

CrowdSec, the collaborative security engine used by more than 100,000 machines to share attack data, confirmed on 17 September that its private source code was exposed in May 2026 through a compromised build of TanStack. The company said the same supply-chain vector hit Mistral AI.

CrowdSec's Security Engine repositories are public by design. The private repositories held the code for the CrowdSec SaaS console, some AWS routines, connectors and automations. CrowdSec put the total at 130-plus public repositories and about 300 repositories overall once the private ones are counted in, and said that headline number mostly reflects how the code is split rather than how much was written.

The vector was a TanStack component in use inside CrowdSec during May 2026 that had been backdoored to steal an API key with read access to the private codebase. The leak window was short and closed once the poisoned build was removed. CrowdSec said all tokens and credentials with any exposure were rotated at the time.

CrowdSec said no customer data, credential, name or organisation was affected, and that it does not store personally identifiable information or client logs on its side. The company's own team searched the leaked private code for tokens and other material that would help an attacker move sideways into CrowdSec systems and said it found none as of the statement.

CrowdSec argued that the code on its own poses a limited threat: the product depends on the shared pool of attack data from its users, and the SaaS code has been through regular audits. The code has also moved on across four months of ongoing development. Reuse outside CrowdSec is unlikely, the company said, because the code only interacts with CrowdSec data and tools.

That is the vendor's own account, and worth reading with the usual caveat: CrowdSec cannot prove that no one who saw the code has since found a bug in it. Users should treat the statement for what it is, a description of what CrowdSec has checked so far.

The company credited a group called Fuites Infos with the disclosure.

For teams that ship software with modern JavaScript stacks, the TanStack detail is the part worth acting on. The statement also names Mistral AI as hit by the same compromise, and any team that installed the affected TanStack build during May 2026 is on the same supply-chain path. That means an audit of package lockfiles and CI logs for TanStack installs in that window, an inspection of CI/CD tokens that had read access to a private repository during those weeks, and rotation of any that did. A leaked long-lived read token from that CI pipeline is often more damaging than the leaked code itself.

Source

• Primary: CrowdSec Statement: Source Code Exposure in May 2026 (17 September 2026)
• Community discussion: Hacker News thread