In May 2026 the TanStack npm packages were backdoored with credential-stealing malware. Four months later, an archive of roughly 170 private CrowdSec GitHub repositories showed up on a breach forum — the first CrowdSec heard of it. Their CEO wrote up the whole investigation, including the parts that went nowhere.

The mechanism is mundane, which is the point:

  • A departing employee kept org access to finish up some work, and his laptop was running the compromised packages
  • A live GitHub OAuth token was still embedded in the clone URL inside .github/.git/config
  • Two hours of clones on 22 May 2026 from an IP in Toronto. No commits, no code changes, nothing touched in CI or infrastructure
  • The token was already gone by the time anyone looked — it was created, used, and died without leaving a trace of its own

The forensics nearly stalled there. GitHub’s org audit log only records specific actions, and non-Enterprise plans keep git activity for a rolling seven days. The account was deprovisioned three days after the clone, so the trail had gone cold. GitHub support eventually traced the token’s lifecycle by hand, and that is what confirmed TanStack as the vector.

What limited the damage:

  • Least privilege, applied narrowly: the one usable credential in the dump could only publish to a single SNS topic. The attacker probed it and stopped
  • Serverless AWS with SSM/Secrets Manager, so few credentials live in code at all
  • Most of the tokens present in the dump had already been rotated

What did not hold:

  • No endpoint detection on developer machines — the stated gap, now closed
  • The leak was found by a third party, not by monitoring
  • 83 user emails and 51 investor names and addresses meant the tidy “code only” framing was not true, and it was GDPR-reportable

The takeaway is that this is not really a story about leaked source code. The leaked console and scripts move fast and are too contextual to be worth much elsewhere. What mattered was the unglamorous plumbing — a narrowly scoped token, prompt rotation, and a willingness to publish the parts of the investigation that failed. The pace is the other detail worth stealing: 48 hours from publication to complete inventory, rotation, forensics, and PR, with under 24 as the next target.