CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories

A former CrowdSec employee’s GitHub account was used to copy approximately 170 private GitHub repositories, including sensitive data like email addresses, investor details, and internal code, following a supply chain attack on TanStack. The leak, discovered on September 16, contained CrowdSec’s web console, data science scripts, automation scripts, and consensus algorithm thresholds. The initial impact was limited, but the company now plans to contact affected users and report the leak to investors and authorities. CrowdSec initially downplayed the scope of the breach, stating that ‘No client data, login/password, name, organization, or anything else was leaked,’ and that the impact was limited to the company. However, a September 18 report reveals that the former employee’s account was the source, not a backdoored component as initially stated.

The leak stems from a supply chain attack on TanStack, where malicious versions of TanStack’s npm packages were published in May, stealing credentials from developers’ machines, including GitHub tokens, SSH keys, and cloud credentials. A GitHub OAuth token from the former employee’s account was used on May 11 to copy the code. CrowdSec’s September 18 report indicates that none of the malicious TanStack versions were found in CrowdSec’s code, and points instead to the former employee’s account. The company’s consensus algorithm, which determines which IP addresses are added to its blocklists, is also now publicly known, although it says it can still prevent poisoning of the blocklist.

CrowdSec’s data science team had been studying the 83 exposed email addresses to understand how users interacted with the product. The leaked investor details originated from a 2020 system that CrowdSec says was never intended to be public. The company will report the leak to the investors and to the authorities. CEO Philippe Humeau wrote to the investors in the report that “for this I personally apologize.”

The affected company rotated the exposed credentials on September 16 and 17. It did not require endpoint protection software on developers’ machines at the time, but it now runs such software on the laptops of staff who work with its code or systems. The only usable credential in the leak was for AWS’s SNS notification service, and it could only publish messages to one topic. Someone tried to use it on August 17, a month before the code was posted, but got no further. CrowdSec has approximately 150,000 users.