TanStack npm Attack Leakexposed 170 Private CrowdSec Repos

Attackers linked to the TanStack npm compromise used a stolen GitHub OAuth token from a former employee's account to clone about 170 private CrowdSec repositories.

TeamPCP, also tracked as UNC6780, compromised the TanStack npm ecosystem on May 11 by backdooring 42 packages with the credential-harvesting malware known as Shai Hulud, which targeted GitHub tokens, cloud credentials, and SSH keys on developer machines. Between 05:52 and 06:01 UTC on May 22, an attacker used a GitHub OAuth token belonging to a recently departed CrowdSec employee — an account kept in the organization temporarily to finish outstanding work — to download roughly 170 repositories. CrowdSec removed the account three days later, on May 25. The company says its production infrastructure, customer databases, CI/CD pipelines, and open-source code were not altered or directly compromised.

The leaked archive, published September 16, contained SaaS console components, data-science scripts, automation tooling, the company's Consensus Algorithm for IP blocklisting, and 130+ public repos alongside private code. CrowdSec says exposed console code contained no sensitive information but concedes that published source can help adversaries find weaknesses faster. A former employee's lingering org membership did the rest.

Git metadata in the archive pointed to cloning from an IP geolocated to Toronto, Canada, with a UTC-4 system timezone. According to Cyber Press, CrowdSec initially struggled to find the token in audit logs because it had already expired or been revoked; GitHub support later reconstructed the token lifecycle. Forensics found a remote URL containing an `oauth2:gho_` token, confirming OAuth-based cloning. One still-valid AWS SNS credential, named `assertible-zapier-sns-sender`, was tested on August 17 from IP 23.234.84.102 with GetCallerIdentity and ListTopics requests; GBHackers reports the role's narrow permissions stopped further access. The archive also held emails for 83 users (under 0.05% of ~150,000) and 2020 contact details for 51 potential investors.

The incident shows how a poisoned npm dependency can cascade far beyond one workstation: harvested credentials gave attackers private source code, and the leak went public months later on a criminal forum. CrowdSec says it rotated credentials, revoked remaining tokens, ran forensic reviews, and communicated publicly within 48 hours of discovering the leak, crediting GitHub, GitGuardian, Aikido, and Fuites Info for assistance. Remediation now centers on endpoint detection and response on workstations that touch code or infrastructure, stronger GitHub activity monitoring, faster credential reviews, and reinforced employee offboarding — the exact gap the attackers exploited. Affected individuals will be notified and authorities informed.