CrowdSec says a poisoned TanStack package exposed its private source code
The May leak involved CrowdSec's SaaS, AWS and automation repositories; the company says it found no customer data or credentials that could enable lateral movement so far.
By RuntimeWire Staff · Published
Primary source: CrowdSec
Why it matters
The leak reached the commercial code surrounding CrowdSec's open-source engine and was disclosed four months after the suspected access, testing the CI/CD controls behind its security pitch.
CrowdSec, the collaborative security business led by Philippe Humeau (@philippe_humeau), disclosed on September 17th that an intruder accessed private GitHub repositories during a short window in May. CrowdSec learned of the exposure on September 16th, leaving roughly four months between the suspected access and an outside researcher bringing it to CrowdSec's attention.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.