Cybersecurity company CrowdSec has traced the theft of private source code to a GitHub account compromised following the TanStack npm supply-chain attack earlier this year.
The stolen code appeared on a breach forum on September 16, but CrowdSec’s investigation found that its repositories had been downloaded months earlier, on May 22. The affected GitHub account belonged to a developer who had recently left the company but temporarily retained access to finish remaining work.
CrowdSec concluded that credentials associated with the account had been exposed during the May TanStack compromise.
Private Repositories Were Downloaded
An OAuth token linked to the former employee’s GitHub account was used to clone CrowdSec repositories during a brief period on May 22.
The account was removed from CrowdSec’s GitHub organization three days later, but the repositories had already been copied.
The company found no evidence that the attacker changed source code, modified its build pipelines or gained access to production infrastructure or databases. The compromised account was used to download repositories rather than alter them.
The leaked material did contain some sensitive information. CrowdSec identified one still-valid AWS credential with limited permissions, along with email addresses belonging to 83 users and names and email information for 51 potential investors from 2020.
CrowdSec said the exposed user addresses represented less than 0.05% of its roughly 150,000 users.
Access Traced Back to the TanStack Attack
The incident was linked to the TanStack supply-chain compromise earlier this year.
Attackers published malicious versions of packages from the TanStack Router and Start project that were designed to search developer environments for credentials, including GitHub, cloud-service, npm and SSH credentials. TanStack detected the malicious releases quickly and removed them, but credentials collected while the affected packages were installed could remain usable until they were revoked.
CrowdSec’s repositories were downloaded 11 days after the TanStack incident, which they verified with information obtained from GitHub that allowed the company to trace the OAuth token back to the affected developer account.
CrowdSec Tightens Developer Security
CrowdSec rotated remaining credentials after discovering the leak and reviewed its development and cloud environments for additional unauthorized activity.
The company has also begun requiring endpoint detection and response software on developer workstations. That type of protection was not mandatory when the compromise occurred.
The incident also highlighted a risk that can persist after a software supply-chain attack appears to be over. Removing malicious packages stops new installations, but credentials already taken from developer systems can continue to provide access until they are identified and revoked.
TanStack says the original compromise was limited to its Router and Start repository and that currently available package versions are safe to install. Organizations that installed affected versions during the May incident were advised to rotate credentials that may have been accessible from those systems.
Leave a Reply