CrowdSec said its May breach was a minute-scale theft of about 170 private GitHub repositories, and reporting now ties that access to a former employee’s stolen GitHub OAuth token. Dark Reading and CrowdSec said the token came from a machine compromised in the TanStack npm supply-chain attack, and CrowdSec confirmed the leak was limited to source code.
The mechanism is simple: the token stayed valid after the employee left, so once the worm stole it, GitHub treated the downloads as legitimate and the attacker could pull private repos without touching CrowdSec’s infrastructure. CrowdSec said its databases and build pipelines were not accessed or altered.
For organizations that rely on GitHub tokens and app grants, the exposure sits in offboarding and token lifetime as much as in malware cleanup. If a former employee’s credentials can still read private code, a supply-chain infection on one laptop can become a fast bulk repo loss elsewhere.
Shai-Hulud Attack Nips Cyber-Firm CrowdSec's GitHub Data
Threat actors stole the contents of 170 private repositories with a stolen OAuth token of a former employee through the TanStack npm supply-chain attack.