CrowdSec source code leak

CrowdSec source code leak

CrowdSec has disclosed details of an incident in which attackers gained access to its private GitHub repositories. The company believes the compromise was connected to the TanStack supply chain attack in May, when malicious versions of dozens of packages were published to npm.

On May 11, an attacker compromised the TanStack Router/Start publishing process and released 84 malicious versions of 42 npm packages. The embedded payload harvested AWS, GCP, Kubernetes, Vault, GitHub, npm, and SSH credentials and was capable of propagating further through packages maintained by victims. TanStack detected the attack roughly 20 to 26 minutes later and soon deprecated all affected versions.

According to CrowdSec, one of the victims was a former employee. His GitHub access had been temporarily retained after he left the company so that he could finish work on several tasks. On May 22, his account was used to download approximately 170 private CrowdSec repositories. Access was revoked on May 25.

CrowdSec only became aware of the leak on September 16, when an archive containing its source code appeared on a hacker forum. The investigation found that the attacker had used a GitHub OAuth token. GitHub helped CrowdSec reconstruct the token’s lifecycle and trace the repository downloads back to the former employee’s account. According to CrowdSec, GitHub’s investigation also supported the company’s suspicions about a connection to the TanStack attack.

According to CrowdSec, the impact was largely limited to the exposure of source code: • AWS infrastructure and databases were not compromised; • source code, CI/CD pipelines, and released products were not modified; • the exposed secrets included a valid AWS token for SNS, but its permissions were restricted to publishing to a single SNS topic; • the leaked archive contained the email addresses of 83 users and information about 51 prospective investors dating back to 2020.

In August, someone tested the permissions of the exposed AWS token by calling GetCallerIdentity and ListTopics. However, its minimal permissions prevented the access from being expanded further. CrowdSec also found no evidence that any repositories had been modified or that the compromised account had been used for anything other than cloning source code.