TL;DR — Key Takeaways
- A TeamPCP npm supply-chain attack on TanStack led to the theft of source code from about 170 private CrowdSec GitHub repositories after attackers hijacked a former employee’s OAuth token.
- CrowdSec didn’t detect the breach until the stolen code surfaced on a dark-web forum months later, exposing AWS credentials, 83 user email addresses and information on 51 potential investors.
- The incident highlights two major gaps: developers lacked endpoint detection and a former employee’s access wasn’t cut off quickly enough.
About 170 private GitHub repositories belonging to French cybersecurity company CrowdSec were compromised and source code was stolen by attackers earlier this year in the wake of an npm supply chain attack in May by the notorious TeamPCP threat group on TanStack.
TeamPCP used the Mini Shai-Hulud self-propagating worm to grab credentials and tokens and published 84 malicious artifacts across 42 TanStack packages, and CrowdSec GitHub repositories were caught up in the attack.
CrowdSec, which crowdsources threat intelligence, earlier this month learned that source code had been stolen from the laptop of a former employee that was compromised in the TanStack attack. An OAuth token taken from the ex-employee’s GitHub account still had permission to read the vendor’s private inventories.
TeamPCP on May 22 took credit for the supply-chain attack on TanStack 11 days earlier. In all, about 300 CrowdSec public and private repositories were compromised. Also on May 22, one of the founders of the BreachForum hacking site and another member downloaded the contents of the private CrowdSec GitHub repositories from an IP address in Toronto, Canada, a process that took about nine minutes.
Revocation Was Too Late
Three days later, the company revoked GitHub access to the former employee’s laptop, but by that time the damage was done. However, the theft of the source code was undetected until September 16, when it was leaked on pwnforum, a dark web cybercrime marketplace.
The damage wasn’t widespread, with CrowdSec researchers writing that “no client data, login/password, name, organization, or anything else was leaked, and CrowdSec doesn’t store PII or client logs; the impact is limited to CrowdSec.”
However, as CrowdSec CEO Philippe Humeau wrote in a blog post, “we were very close to clean.” Among the leaked information was a token for using Amazon Web Services’ (AWS) Simple Notification Service.
“Our infrastructure is AWS serverless, and we make heavy use of SSM/Secrets Manager, so the number of credentials present is very low but still warrants analysis,” Humeau wrote. “Most of the tokens and secrets present in the source code had been revoked or rotated before the leak, but we can see that the ones present and usable have been probed.”
Information Leaked
In addition, a small amount of client and partner information was leaked, including some email addresses – mostly Gmail – of 83 users, or less than 1% of the company’s 150,000 users. Also disclosed were the first and last names of 51 potential investors dating back to 2020, along with their email addresses and their investment context.
CrowdSec researchers initially had trouble tracking the stolen OAuth token to the source, but with help from GitHub support staff, they were able to determine it was taken from the laptop of the former employee “who had just left the company, but that was still part of the GitHub organization for legitimate reasons, and his account was used to dump the repositories,” the CEO wrote.
He detailed the range of security features CrowdSec has in place, including privilege separation, two-factor authentication, audits, logs, penetration testing, automated code analysis, and age monitoring for npm nodes.
No EDR or Access Cutoff
However, there were a couple of security issues. One was not having endpoint detection and response (EDR) on developers’ systems, though that’s changed, according to Humeau. He wrote that the company is using it to focus on such threats as malicious packages and extensions.
“As supply chain attacks become the new plague and virtually anyone can get caught in them, we should have done this earlier,” he wrote.
The other was not immediately cutting off access to the former employee’s laptop after he left the company. In a study by job search platform Zippia, 76% of IT leaders surveyed strongly agreed that offboarding represents a significant security threat, with 20% of companies saying they had experienced a data breach connected to a former employee.
“Prompt access revocation is important during the offboarding process to protect company data, prevent security breaches, and maintain compliance with legal and regulatory standards,” officials with identity management vendor Lumos wrote. “When an employee leaves, failing to revoke their access rights can quickly lead to unauthorized access, data breaches, and the potential misuse of sensitive information.”
Frequently Asked Questions
How were CrowdSec’s private GitHub repositories compromised?
Attackers obtained an OAuth token from a former employee’s laptop after it was caught up in the TanStack npm supply chain attack. The token still had permission to read CrowdSec’s private GitHub repositories.
What information was exposed in the CrowdSec incident?
The attackers downloaded source code from roughly 170 private repositories. CrowdSec also said a limited amount of user and investor information was exposed, along with some tokens and secrets, most of which had already been revoked or rotated.
What security lessons did CrowdSec identify after the breach?
CrowdSec highlighted two major gaps: the lack of EDR on developer systems and the failure to immediately revoke access from a former employee’s laptop. The incident underlines the importance of endpoint protection, rapid offboarding and tighter control over developer credentials and OAuth tokens.
