CrowdSec says attackers copied approximately 170 private GitHub repositories using a former employee’s stolen authentication token. The company had kept the employee’s GitHub access active after departure so unfinished work could be completed.
The security company published its final incident account on September 18 after an archive appeared online two days earlier. Its investigation dates the copying to a roughly nine-minute period on May 22, four months before the stolen archive appeared online.
CrowdSec linked the compromise to a supply-chain attack against TanStack software packages. It says the former employee’s account was compromised through that attack and then used to clone the repositories. The company removed the account from its GitHub organization on May 25, three days after the copying occurred.
The credential was an OAuth token, a software credential that can authorize access to an account without another interactive sign-in for each operation. GitHub helped trace the token’s history after CrowdSec’s own audit records failed to identify it because the associated access had already been removed.
CrowdSec says the account was used only to copy repositories, with no commits or changes to source code, infrastructure or continuous-integration systems. Other access held by the departed employee had already been revoked.
The leaked material included an AWS token restricted to a notification service, which the company rotated. CrowdSec also identified 83 user email addresses and records containing names, email addresses and investment context for 51 potential investors from 2020. It said affected people would be contacted and the investor-data exposure reported to the appropriate authorities.
Stolen service credentials can remain useful independently of a person’s normal sign-in process. Recent research into public AI-tool configurations found hardcoded access tokens and secrets retained in repository histories even after removal from current files.
A separate forum and single sign-on exploit chain at OpenAI demonstrated how access to one connected service could reach an employee account and an internal GitHub repository. That case involved different vulnerabilities and authorized security testing.
CrowdSec has added endpoint protection to workstations used by people who interact with its codebase or infrastructure. The company says the software focuses on malicious packages and extensions, supplementing existing credential scoping, access controls and automated code analysis.
Sources: CrowdSec
–
By the ID Tech Editorial Team
