Backdoored dependency exposed CrowdSec's source for months

A backdoored dependency exfiltrated an API key with read access to CrowdSec's private codebase, the company said September 17. The backdoor sat inside CrowdSec's build for four months, exposing SaaS console source, AWS routines, connectors and automations to anyone holding the key.

CrowdSec published a statement on the exposure saying it discovered the compromise on September 16, tracing the exposure to a short window in May 2026. No client data, credentials or PII were involved, and CrowdSec rotated every token tied to the key.

Rust's crates security team posted a warning about the campaign targeting rust-lang members and popular crate owners, also on September 17. Attackers set up fake video calls under job-offer or contract pretexts. They then pressure targets to install a fake audio codec or run clipboard-manipulating commands. The goal is account takeover and malware published under a trusted maintainer's name. The arrayref crate fell to this in August.

The team's headline mitigation is a dependency cooldown. Wait several days before upgrading to a new release so the community has time to catch anything malicious. That's a lockfile policy any team can adopt this afternoon.