A hacker downloaded 170 of CrowdSec's private GitHub repositories on May 22, using an employee's account that had just been terminated, according to CrowdSec on September 18 This article explores crowdsec private github. . CrowdSec revealed that a laptop belonging to the individual was compromised during a May supply chain attack on TanStack.
CrowdSec confirmed that the account was solely used for copying code and that the infrastructure and databases were not accessed, as well as stating that no modifications were made to the code. Installing these versions ran code that stole credentials from the machine, including GitHub tokens, SSH keys, and cloud credentials, as per TanStack's advisory. The archive contained the company's web console, data science scripts, models, automation scripts, and the consensus algorithm used to add IP addresses to blocklists.
According to the company, the code was almost four months old and had undergone significant changes since its creation. It states that an attacker would need to receive detections from multiple trusted engines across various networks, at considerable expense. The sole accessible credential from the leak pertains to AWS's SNS notification service, which can only publish messages to a single topic.
It did not require any endpoint protection software on the developers' machines at that time, but it now uses such software on the laptops of staff who work with its code or systems.
