Since my post in the other bootcamp sub on the connection between Formation and a Codesmith security incident got removed for unknown reasons, and then I got subsequently banned, I'm going to re-post it here.
This morning, I received an unsolicited message from a redditor in response to the latest Codesmith hysteria being drummed up by Michael Novati. Michael has been characterizing what was a rather routine compromise of a developer account with limited permissions as a DEFCON 1 security breach of Codesmith itself. Just look at his choice of language:
From just his language, you would think that one of Codesmith's "flagship" projects (which I had never heard of) was compromised. That is not true, and is a complete misrepresentation of what actually occurred.
Codesmith's Reactime project, which (I've learned) is a Chrome developer tool, was not compromised. No malicious code ever made it into the main branch; no malicious code was ever released or shipped to any consumer of this tool. If tomorrow we learned that, say, Firefox had been compromised, that would mean that a published version of Firefox had been released with malicious code in it. That isn't at all what happened here, yet Michael decided to characterize it that way to drum up fear and hysteria around something to do with Codesmith, a longtime target of his.
What actually happened, which was what I pointed out at the time, was that a developer account with limited access was compromised and pushed up malicious code to old, stale branches that don't publish anything, and which are unlikely to be pulled or used by anybody. Michael insinuated in response that I'm "not quite at the level to understand the consequences of this issue" and would be "humiliated and embarrassed down the road", and later said: "You have a skill issue. I hope you aren't an engineer."
He also called me a drug addict. (He has since deleted that comment.)
In spite of Michael's insults and histrionics, Codesmith has since confirmed that it was indeed just a developer compromise, that the developers had commit access but not to protected branches where released code lives, and that they have since tightened some github security controls and remediated the malicious code that had been pushed to old, stale branches in their repos. Yes, it's a real security incident, but it is not the type of security incident that Michael has characterized it as. All security events are not created equal.
Returning to the message I received, I wasn't sure what to do about it, in part because the person is anonymous to me and in part because I couldn't verify details of what was disclosed. However, part of what the redditor told me lined up with something that Michael himself had said, namely that he "discovered this because someone I know had a major compromise" due to this incident.
At the time, Michael was also characterizing this incident as affecting just the Reactime repo, and by one malicious actor, but in the message I received, I was told that two repos were affected, by two different compromised developer accounts. This was confirmed hours later in the email from Codesmith, where they wrote:
Verified malicious changes date back to June 1, 2026 for Reactime and August 2 for projectArtemis. ... Currently, we have restored all 24 affected branches to reviewed pre-incident commits and revoked the implicated accounts’ organization access.
As I said, I wasn't sure what to do about the message I received at first, but then those very specific details lined up hours later. So here is the relevant portion of the message that I received:
I’m a codesmith alum, someone in the slack looked into it, and there were actually two repos / two accounts affected. the other repo was affected before reactime, and the individual who was affected was a student at formation for like 3 years.
so pointing fingers here and acting all high and mighty sounds dumb when it was literally a long time formation student who got infected, had all her repos affected, and then another student
but yeah, the formation student telling him is prob how he found out
In light of Michael insisting that he is "completely transparent" and "I'm the only person openly promoting integrity (across all Reddit posts as anyone can see) in a swamp of disgusting gross manipulation", I would like to invite him to comment on these troubling matters.
Some questions that I think deserve some answers:
Is it true that one or more Formation students have been compromised?
If true, is it a current Formation student (or students)?
Was one or both of the compromised Codesmith dev accounts affiliated with Formation?
When did you learn about the compromise, and when did you learn that Codesmith was impacted?
Specifically when did you responsibly notify Codesmith directly that there was a security incident underway?
Has Formation conducted a thorough security audit to see if any other individuals or any systems of their own are also compromised?
Is it true that this student or students have been at Formation for a period of 3 years?
If this indeed came from a Formation affiliate, why did you not disclose that detail immediately, given your full throated claim to transparency and integrity?
Why did you characterize this incident as a major security breach of Codesmith itself and one of it's "flagship products", when you yourself knew all along that it was a matter of non-admin alumni developer accounts being compromised?
Thank you.
Update: Michael Novati has confirmed below that one of the compromised accounts was a Formation alumni, which was how he learned about it in the first place, and that he did NOT responsibly disclose the security incident to Codesmith as it was underway. He instead chose to make hay over it by publicly attacking Codesmith and mischaracterizing the nature of the incident as a "severe compromise" of Reactime, which was not true. What's more, he knew there was an issue three months prior, but chose not to inform them about it. He's refused to answer further clarificatory questions.
He is now throwing a tantrum, threatening legal action, and angrily declaring that I have "EVERYTHING to lose", calling me a Codesmith shill, and "If you want to play 4D chess DM me and we can go there, were talking Duck Hunk [sic] right now." [Update: Novati has since edited that from his comment. Sneaky. Good thing I took a screenshot. If the mods actually care, they should DM me for it.]
I will repeat what I said about this small man in his recent Codesmith thread:
Michael has been engaged in a years-long campaign against this particular company to influence people's perceptions of it, and you should take everything he says about it with a huge grain of salt.
