CrowdSec confirmed that threat actors gained unauthorized access to 170 private repositories on GitHub by leveraging an OAuth token stolen from a former employee's personal computer. The attack vector involved a supply chain compromise of the TanStack npm package, which was used to facilitate access to the GitHub resources. The incident was first reported by Dark Reading on September 22, 2026. CrowdSec has indicated that the compromised OAuth tokens have been revoked and additional access controls may have been implemented, though specific technical details of the supply chain mechanism remain limited in the public report.

What should defenders do?

CrowdSec has revoked the compromised OAuth tokens and is likely reviewing and strengthening access controls. Organizations should rotate credentials for former employees, enforce principle of least privilege for code repository access, and monitor for suspicious OAuth token usage. Supply chain hygiene for npm packages should be audited, and access to critical repositories should be protected with multi-factor authentication where possible.

highCyber Attacks

CrowdSec GitHub Compromise via Former Employee OAuth Token

Threat actors exfiltrated 170 private repositories through a TanStack npm supply chain attack

CyberIntel DeskPublished 6 days agoUpdated less than a minute ago1 min read

CrowdSec GitHub Compromise via Former Employee OAuth Token

Key Takeaways

Threat actors accessed 170 private CrowdSec repositories via a stolen OAuth token from a former employee's computer.
The attack vector included a supply chain compromise involving the TanStack npm package.
CrowdSec has revoked the compromised OAuth tokens and may have implemented additional access controls.
The incident highlights the risk of credential theft from former employee devices and the potential for supply chain attacks to facilitate unauthorized access to code repositories.

Related Security News

highCyber Attacks

Former US Air Force Members Sentenced to Prison for Business Email Compromise Scams

Two former members of the United States Air Force were sentenced to a combined 189 months in federal prison for their roles in a multi-year series of business email compromise (BEC) scams and phishing campaigns. The sentencing, reported by BleepingComputer in September 2026, concluded a federal case targeting individuals who abused their military backgrounds to conduct financially motivated email fraud. The attacks spanned multiple years prior to sentencing, though specific victim counts and total financial losses were not detailed in the reporting. The case underscores the legal consequences of using military credentials and training for cyber-enabled fraud.

BleepingComputerabout 5 hours ago1 min read