TeamPCP Supply Chain Attack Leads to CrowdSec Source Code Being Stolen

A French cybersecurity firm called CrowdSec experienced a supply chain attack on May 22, resulting in the theft of source code from 170 of its private GitHub repositories. The attack was carried out by the TeamPCP threat group, who had previously targeted the npm package manager. TeamPCP utilized a self-propagating worm to obtain credentials and tokens, publishing 84 malicious artifacts across 42 TanStack packages.

The stolen source code remained undetected until September 16, when it was leaked on a dark web cybercrime marketplace. CrowdSec, which collaborates with other organizations to share threat intelligence, had not yet realized the extent of the breach. The stolen information included an Amazon Web Services (AWS) Simple Notification Service token, email addresses of 83 users, and the first and last names of 51 potential investors dating back to 2020.

CrowdSec had implemented several security measures, such as privilege separation, two-factor authentication, audits, logs, and automated code analysis, but failed to employ endpoint detection and response (EDR) on developers' systems and did not promptly revoke access to the former employee's laptop upon his departure from the company.