[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f6HdiTklkW5r8OmBSdJ8UARlS9Fpjzb7LwgiLl10ueWw":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":56},"dc18b908-aee0-4053-aa3e-ee15ed63921e","crowdsec-source-code-stolen-via-third-party-supply-chain-attack","8d0509e4-17ce-4db9-9b98-657e26ee081a","CrowdSec Source Code Stolen via Third-Party Supply Chain Attack","CrowdSec's GitHub repositories were compromised as a downstream consequence of the TanStack supply chain attack, where malware likely harvested an API key that granted access to approximately 300 repositories, including 170 private ones. This incident illustrates how a single compromised third-party dependency can cascade into a serious breach for organizations that trust it — even security-focused companies are not immune. The exposure of proprietary source code, while not immediately weaponizable externally, can enable adversaries to identify hidden vulnerabilities, hardcoded secrets, or internal architecture details for future attacks. This underscores the critical need to treat third-party integrations as potential attack vectors and to apply the principle of least privilege to all API credentials and tokens.","**Immediate actions:**\n- Rotate and revoke all API keys, tokens, and secrets that may have been exposed through compromised third-party dependencies.\n- Audit all third-party integrations and dependencies for signs of compromise, especially those involved in recent known supply chain incidents.\n\n**Long-term improvements:**\n- Apply the principle of least privilege to all API keys and service accounts, scoping permissions to only what is strictly necessary.\n- Implement a Software Bill of Materials (SBOM) practice to maintain full visibility into all third-party libraries and services in use.\n- Establish a formal third-party risk management program that includes continuous vetting of upstream vendors and open-source dependencies.\n\n**Detection measures:**\n- Enable alerting on anomalous repository access patterns, such as bulk cloning or unusual API key usage in source control platforms.\n- Deploy secret scanning tools (e.g., GitHub Advanced Security, Trufflehog) to detect exposed credentials in repositories before attackers can exploit them.\n- Monitor threat intelligence feeds for newly disclosed supply chain attacks and assess exposure within 24 hours of disclosure.",[12,13,14,15,16,17,18,19,20,21],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 6: Access Control Management","CIS Control 12: Network Infrastructure Management","NIST SP 800-161: Cybersecurity Supply Chain Risk Management","NIST AC-2: Account Management","NIST AC-6: Least Privilege","NIST SR-6: Supplier Assessments and Reviews","NIST DE.CM-3: Personnel Activity Monitoring","ISO\u002FIEC 27001 A.15: Supplier Relationships","SLSA Framework: Supply-chain Levels for Software Artifacts",{},"published","2026-09-21T12:20:54.387454+00:00","2026-09-21T12:20:54.195+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.securityweek.com\u002Fcrowdsec-confirms-source-code-stolen-in-supply-chain-attack\u002F","crowdsec-confirms-source-code-stolen-in-supply-chain-attack-041aae","CrowdSec Confirms Source Code Stolen in Supply Chain Attack",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":38,"name":39,"slug":40,"description":41,"color":42},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":44,"name":45,"slug":46,"description":47,"color":48},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[50],{"id":51,"date":52,"edition":53,"title":54,"audio_url":55},"cfbb6e88-6c52-4e82-9727-1068c8a790a0","2026-09-21","afternoon","ThreatNoir Afternoon Brief — September 21","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-09-21\u002Fthreatnoir-afternoon-brief-2026-09-21.mp3",[57,61,65],{"slug":58,"name":59,"problem":60},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"slug":62,"name":63,"problem":64},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",{"slug":66,"name":67,"problem":68},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]