Attacker copied 170 CrowdSec repositories with a departed employee's still-live GitHub token

Two controls had to fail at once. The npm compromise pulled credentials off a developer's laptop, including GitHub tokens, SSH keys and cloud credentials, according to TanStack's advisory ^[8]. The leaver's membership in the CrowdSec organization gave one of those tokens something to read. CrowdSec says it kept his access open so he could finish some work ^[9]. His other access had already been removed, and the company says that is why it saw no suspicious activity in its AWS systems ^[11].

The copy went undetected for 117 days ^[1]. CrowdSec says the token left no trace in the GitHub logs it could check, and that the token no longer existed by the time it learned of the leak ^[12]. GitHub support then traced the token's history and confirmed the company's suspicion that TanStack was the source ^[13].

CrowdSec says the only working credential in the archive was for AWS's SNS notification service and could publish to a single topic; someone tried it on August 17 and got no further ^[20]. Other tokens in the code had been rotated or could not be used from the internet, as far as the company knows ^[21]. The exposed credentials were rotated on September 16 and 17 ^[25].

The repositories include the one part of the archive that stays useful after the code goes stale: the consensus algorithm that decides which IP addresses go onto CrowdSec's blocklists ^[16]. The leak revealed the thresholds it uses, such as how many detections an address needs before it is added ^[18]. Those thresholds had not been public ^[18]. CrowdSec says poisoning the blocklist would still require tens of detections from tens of trusted engines across tens of separate networks, at great cost, and that it can change the thresholds, as it often does ^[19]. The company says the code is almost four months old and has changed a lot since ^[17].

The leak exposed 83 user email addresses against about 150,000 users, roughly 0.06 percent ^[2]. CrowdSec's data science team had kept those addresses to study how people used the product, and the company says it will contact the users ^[22]. The second set is 51 potential investors from 2020, with names, email addresses and investment context, from a system CrowdSec says was never meant to be public ^[5][23]. CEO Philippe Humeau wrote to the investors in the report that "for this I personally apologize." ^[24]

CrowdSec did not require endpoint protection software on developers' machines in May; it now runs such software on the laptops of staff who work with its code or systems ^[26]. It says those machines were checked and came back clean ^[14]. CrowdSec has not said which malicious package reached the former employee's laptop, and its report leaves out GitHub's own findings ^[14]. The report asks nothing of users, and neither did CrowdSec's first statement ^[27].