Lucide Security Incident Postmortem
Summary
In mid-2026, an attacker exploited an unpatched CVE to gain unauthorized access to one of our servers, and from there obtained our GitHub and Cloudflare DNS credentials. They used those credentials to inject malicious code into production, which enrolled visitors' browsers in a DDoS botnet and ran unauthorized ad activity. This credential compromise is a separate incident from the npm-related events described below; the two are unrelated except in how we ultimately found out about it.
We identified the breach, removed the injected code from our sites and repository, rotated every credential the attacker could have touched, and audited for anything left behind. No further incidents have occurred since.
Separately, a third party purchased a batch of npm packages under their own npm account, unconnected to us or to the credential compromise above. That activity drew the attention of security researchers, who began investigating npm packages referencing our branding. In the course of that research they found the injected code still present in our public svg mirror repository (lucideproxy/svg) and traced it back to the credential compromise. JFrog Security Research later published a writeup covering both. We are publishing our own account of the credential-compromise incident: its timeline, root cause and remediation.
Timeline
- Earlier this year — An attacker exploited an unpatched vulnerability on one of our servers, gained access, and used it to steal our GitHub and Cloudflare DNS credentials. Those credentials were used to inject malicious code into our public svg mirror repository.
- Around the same time, unrelated — A third party purchased a batch of npm packages under their own account, with no connection to us.
- Weeks later — That npm activity drew security researchers' attention to packages using our name. While investigating, they found the leftover injected code and traced it to our credential compromise.
- Once we learned of it — We removed the malicious code, rotated every credential involved, and audited for anything else left behind. No further incidents since.
- July 2026 — JFrog Security Research published a writeup naming indicators that trace to our infrastructure.
Root cause
An attacker exploited an unpatched, publicly known vulnerability on one of our servers to gain unauthorized access. From there they obtained our GitHub and Cloudflare DNS tokens and used them to push unauthorized changes that injected malicious JavaScript into our public svg mirror repository (lucideproxy/svg), which reached production through our normal mirror/bootloader distribution — bypassing our usual review and deploy process.
We did not write, authorize or knowingly ship any of the injected code. The underlying proxy codebase (Scramjet/Wisp based) was not itself compromised; this was a server-security and credential-exposure failure — an unpatched vulnerability being exploited — not a flaw in the proxy's own logic.
Impact
- Visitors to affected sites had their browsers silently enrolled in a DDoS botnet without their knowledge.
- Unauthorized ad/popunder code ran on affected pages.
- Our GitHub repository and Cloudflare DNS were under attacker control for part of the incident window.
We are not aware of any user credentials or personal data being exposed in this incident.
Detection
We did not catch this ourselves. It surfaced only because the unrelated npm-purchase activity drew researchers to packages using our name, and they found the leftover injected code in our svg mirror repo.
Remediation
Once the breach was identified, we:
- Removed the malicious/injected code from all affected repositories and live sites.
- Rotated the leaked GitHub and Cloudflare DNS tokens.
- Rotated other secrets as a precaution, not just the ones confirmed leaked.
- Audited the repository history, DNS records, GitHub organization settings and deploy infrastructure for anything else the attacker might have left behind (extra collaborators, webhooks, API tokens, changed DNS records, scheduled jobs).
- Reviewed which npm packages we actually own and publish, to separate our real packages from ones using our branding without authorization.
Current status
The incident is resolved. We have seen no further unauthorized activity since remediation. All credentials involved have been rotated, and we continue to monitor for recurrence.
If you believe you were affected, feel free to reach out.
Lessons learned and follow-ups
- Patch management: the attacker got in through an unpatched, known vulnerability. We're tightening our patch cadence and CVE monitoring across the fleet.
- Credential blast radius: one leaked token gave access to both source control and DNS. We're scoping tokens more narrowly and adding change alerting.
- We relied on outside researchers to catch this. We're adding our own monitoring for unexpected repo pushes, DNS changes and unusual relay traffic.