decrypted · 20 september 2026 · ransomware and cybercrime · vulnerabilities and patching · supply chain

A leaver's forgotten login and a poisoned npm package cost CrowdSec 170 repositories

Security company CrowdSec said this week that about 170 of its private code repositories were copied in May, and that it only found out when the code appeared on a cybercrime forum on 16 September. The way in was not a clever attack on CrowdSec. It was a poisoned open source package on a former employee's laptop, plus a login that had been left switched on out of politeness.

What happened

On 11 May, attackers published 84 malicious versions of 42 TanStack npm packages. Installing one ran code that stole credentials from the machine, including GitHub tokens, SSH keys and cloud credentials. CrowdSec says the laptop of a developer who had just left the company was hit. On 22 May, someone used that developer's GitHub OAuth token to clone roughly 170 private repositories. CrowdSec revoked the access on 25 May, three days later.

The company's own report is candid about why the access was still live: "We kept them alive because we parted on good terms with our developer, and he wanted to finalize some work."

CrowdSec says no code was altered, its infrastructure and databases were not accessed, and more than 130 of the copied repositories were already public. The personal data involved is limited: 83 email addresses out of about 150,000 users, and the names of 51 potential investors from 2020. An AWS credential in the leaked code was tested on 17 August, but CrowdSec says the role was limited to a single notification service.

Why two-factor did not help

Think of a building pass. Two-factor authentication is the guard checking your face on the day the pass is issued. After that, the pass does the talking. Malware that lifts the pass from a coat pocket never needs your face, which is why a token already authorised on a developer's machine walks straight past the second factor.

The Secure by Design lesson

This is a design problem, not a discipline problem. A system that relies on someone remembering to remove access, or on every developer never installing a bad package, will eventually fail. Better defaults look like this:

Leavers lose access on their last day. Finishing work happens through a time-limited account that expires by itself.
Tokens are short-lived, so a stolen copy is worth hours, not months.
Developer laptops are treated as production, because that is where the keys live. CrowdSec says it is now rolling out endpoint detection on them, tightening offboarding and monitoring the age of npm packages.
New package versions are not installed the minute they appear.

Almost four months passed between the theft and the leak. Any UK business with software developers could ask its engineering lead three questions: how fast do leavers lose access, how long do tokens live, and what happens on our machines when a package updates? Opinion, not advice.

Also this week

SolarWinds and the key under the doormat. SolarWinds patched CVE-2026-28326 in Access Rights Manager, a product whose job is controlling who can access what. A hard-coded static key allows unauthenticated remote code execution, and the advisory rates it 8.8 on the CVSS scale. Versions 2026.2 and earlier are affected, and 2026.2.1 fixes it. The advisory says an attacker on an adjacent network could exploit it, and SolarWinds makes no mention of exploitation in the wild. A key baked into every copy of a product is a design decision, and every customer inherits it. Secure by Design means a unique secret per installation.

Ransomware gangs get a taste of their own medicine. According to BleepingComputer, the ShinyHunters extortion gang defaced the Tor leak site of the Clop ransomware group after exploiting a file upload flaw in the site's content management system. ShinyHunters claims it also took server logs, source code and the private keys for Clop's onion address, and says it will demand contact within 72 hours. BleepingComputer has not verified those claims, and Clop had not responded. It is hard to feel sorry for either side, but note that a criminal leak site is just another badly patched web server.

Sources