Technology newsroom
CrowdSec Confirms Source Code Stolen! Consequence of Supply Chain Attack via TanStack
CrowdSec, a cybersecurity company, confirms its UI Console source code was stolen via a Supply Chain Attack originating from a malicious TanStack package version. However, all core components and user data remain secure.
📌 Key Highlights:
- CrowdSec, a renowned cybersecurity company, has confirmed that the source code for its frontend (UI Console) was stolen.
- The primary cause was a Supply Chain Attack via a TanStack package that was embedded with malware in May 2024.
- Critical data such as Agent, Security Engine, Threat Intelligence, and all user data remain secure and unaffected.
CrowdSec, a company developing collaborative security solutions, has officially confirmed that it fell victim to a cyberattack, resulting in the theft of some of its source code. This incident serves as a reminder of the escalating threat of Supply Chain Attacks in the developer world.
CrowdSec's investigation revealed that the incident originated from the company's Continuous Integration (CI) system using a malicious version of the TanStack package. This version had data-stealing code secretly embedded by attackers and was published in May 2024. The malware stole the credentials used to access the company's GitHub.
🔒 Scope of Damage
The attackers used the stolen credentials to access CrowdSec's GitHub and download the source code of CrowdSec Console, which is the User Interface (UI) for system management. However, CrowdSec confirmed that the most critical core components of the system remain secure, including the source code of CrowdSec Agent, the Security Engine (the heart of threat detection), Threat Intelligence data (CAPI/LAPI), and most importantly, all user data remains unaffected and was not accessed.
🛠️ Response and Remediation Measures
Immediately upon detecting the anomaly, CrowdSec initiated a rapid response. All related tokens and credentials were revoked, and access logs were thoroughly reviewed to assess the damage and identify further vulnerabilities. The company is confident that the situation is contained, and the impact is limited solely to the Console's source code. The transparent disclosure aims to inform the community and users about the incident.
💬 As IT professionals, how concerning do you find Supply Chain Attacks via everyday libraries? And how can we prevent them?