CrowdSec Source Code Leak: GitHub OAuth Token Abused in TanStack Supply Chain Attack

1. Basic Information

• Title: TanStack Supply Chain Attack Analysis
• Date: 2026-09-18
• Collected: 2026-09-22T08:00:36+09:00
• Source: CrowdSec
• Severity: High
• Severity Rationale: A GitHub OAuth token from a recently departed employee account, compromised in the TanStack supply chain attack, was abused to clone about 170 private repositories in a short time. In addition to source code, the exposed repositories contained 83 user email addresses; the names, email addresses, and investment context of 51 potential investors; and one scoped AWS credential associated with a role permitted to publish to a single SNS topic.
• References: CrowdSec Statement: Source Code Exposure in May 2026
• References: SecurityWeek: CrowdSec Confirms Source Code Stolen in Supply Chain Attack
• CVE: None
• Target Products and Services: CrowdSec GitHub organization, a former employee’s development environment, private repositories, and AWS SNS-related credentials
• Threat Actor: TeamPCP / UNC6780 (TanStack supply chain compromise, according to CrowdSec); diencracked (repository downloads, according to leaked Git metadata analyzed by CrowdSec)

2. Executive Summary

In its final analysis, CrowdSec concluded that the TanStack supply chain attack compromised a recently departed employee account, and its GitHub OAuth token was used to clone approximately 170 private repositories. The entry point was the employee account and OAuth token, not the CI/CD API key theft suggested in initial reports.

3. Attack Flow

From Supply Chain Compromise on Employee Device to GitHub Repository Cloning

1. CrowdSec's investigation concluded that the TanStack supply chain attack compromised the environment used by a recently departed employee. The exact package name and version used in the compromise have not been identified.
2. This employee remained in the CrowdSec GitHub organization even after leaving, and the attacker obtained a valid GitHub OAuth token linked to that account.
3. Between 05:52 and 06:01 UTC on May 22, 2026, the token was used to clone about 170 private repositories in about nine minutes.
4. CrowdSec removed the account from its GitHub organization on May 25.
5. On August 17, the exposed AWS credential was tested using GetCallerIdentity and ListTopics requests. CrowdSec reported no further activity.
6. CrowdSec was notified of the source code exposure on September 16 and published its final analysis on September 18 after investigation.

4. Attacker Posture and Execution Location

• CrowdSec assesses that the initial compromise occurred in the environment of the employee who ran the TanStack-related malicious package. However, the execution device and exact package have not been made public.
• Repository access was an authenticated external operation using a valid GitHub OAuth token.
• No compromise of CrowdSec production infrastructure, databases, or CI/CD systems was confirmed.

5. Impact on Victims and Administrators

Victims

• CrowdSec reported that email addresses of 83 users were included in the source code. No leaks of passwords or customer logs were confirmed.

Administrators

• CrowdSec’s standard organization audit logs did not retain the relevant Git activity. GitHub Support later provided activity for the identified two-hour window, revealing the repository fetches.
• AWS CloudTrail shows requests to GetCallerIdentity and ListTopics using the exposed credential.

6. Conditions for Success and Failure

Conditions for Success

• Acquiring a valid GitHub OAuth token from a device or process affected by supply chain compromise.
• A former employee account remaining in the GitHub organization, with the token holding read permissions for private repositories.
• Large-scale cloning operations against GitHub not being blocked immediately.

Conditions for Failure

• Removing accounts from the GitHub organization upon departure, revoking OAuth app authorizations, and invalidating existing tokens.
• Minimizing OAuth token permissions and lifespans, and detecting and blocking rapid cloning of many repositories.
• Pinning and verifying dependency packages, and monitoring behavior and outbound traffic accessing credentials from development devices.

7. Impact of Successful Attacks

• About 170 private repositories were cloned, exposing source code for the CrowdSec SaaS Console, AWS cloud-related processes, connectors, and automation.
• Email addresses of 83 users, and names, email addresses, and investment details of 51 investment candidates were included.
• One scoped AWS credential associated with a role permitted to publish to a single SNS topic was exposed and later tested via GetCallerIdentity and ListTopics requests.
• No source code modifications or compromises of production infrastructure, databases, or CI/CD environments were confirmed.

8. Observable Logs

• Email: No phishing vector has been reported. Cross-reference departure and offboarding notices with account deletion times.
• Proxy / SWG / DNS: Check for traffic from development devices to npm registries, GitHub, and unknown external destinations. Since the initial compromise device has not been identified, this observation point includes investigative speculation.
• Endpoint / EDR: Check for execution of TanStack-related packages, access to browser and GitHub credentials by Node.js processes, and suspicious outbound traffic.
• Identity / IdP: Check former employee account organization membership, OAuth authorization, token issuance and revocation, and source IP and User-Agent.
• SaaS / Cloud: Check GitHub audit logs for multiple clone operations between 05:52 and 06:01 UTC on May 22, 2026, and AWS CloudTrail for GetCallerIdentity and ListTopics requests on August 17.
• Network: Check for large repository downloads from GitHub to an unusual source in a short time and abnormal outbound traffic from development devices or authenticated sessions.

9. Success Criteria

Confirmed via Public Information

• Application Access Token Compromise Confirmed: CrowdSec concluded that the GitHub OAuth token of the compromised employee account was abused.
• Information Theft Confirmed: About 170 private repositories were cloned in about nine minutes, and later public disclosure of source code was confirmed.
• Limited Subsequent Use Confirmed: GetCallerIdentity and ListTopics requests were observed using the exposed AWS credential, but no further operations were confirmed.
• Subsequent Production Compromise Unconfirmed: No source code modifications or compromises of production infrastructure, databases, or CI/CD environments were confirmed.

Organization-Internal Criteria

• Initial Execution Confirmed: Corroborate the acquisition and execution of affected packages, Node.js processes, credential access, and outbound traffic on the same device and timeline.
• Application Access Token Compromise Confirmed: Check for suspicious sources of OAuth tokens, rapid cloning of multiple repositories, and differences from the user's normal behavior.
• Information Theft Confirmed: Cross-reference GitHub audit logs, transfer volumes, and the contents of published archives.
• Subsequent Compromise Confirmed: Corroborate the use of leaked secrets, cloud API calls, code tampering, and production environment access with other evidence.

10. Investigation Playbook

• Trigger: Start from the continued membership of a departed user account, multi-repository cloning via OAuth tokens, and public release of leaked code.
• Initial Triage: Check GitHub organization members, OAuth authorizations, audit logs, departure dates, account deletion dates, and clone times.
• Endpoint: Preserve potentially affected development devices, npm caches, lockfiles, Node.js process history, and traces in browsers and credential stores.
• Identity and Cloud: Revoke GitHub OAuth tokens, inventory and rotate secrets in code, and check AWS CloudTrail.
• Subsequent Activity: Monitor for re-release of leaked code, vulnerability scanning, secret usage, and additional access to repositories or production environments.
• Containment: Remove departed users from the GitHub organization, revoke their OAuth authorizations, and rebuild affected devices and dependencies.
• Classification: Separate package execution, OAuth token theft, authenticated repository access, source code leakage, and subsequent use of secrets.

11. Detection Ideas

• Single Events: High-priority detection of OAuth token usage by departed users, clones from unusual sources, and enumeration API calls using restricted cloud tokens.
• Timeline Correlation: Link dependency package execution, OAuth token usage, rapid mass cloning, source code publication, and cloud token usage chronologically.
• Hunting: Retroactively investigate lockfiles, npm caches, development device logs, GitHub OAuth authorizations, organization members, and audit logs around May 2026.
• Missing Logs: If device logs or npm caches are not retained after departure, the exact package and execution path of the initial compromise cannot be determined.
• Priority Mitigations: Prioritize immediate offboarding, shortening OAuth token lifespans and enforcing least privilege, detecting mass clones, pinning and verifying dependencies, and removing secrets from source code.

12. Facts / Inference / Hypothesis

Facts

• CrowdSec concluded in its final analysis that a recently departed employee account was compromised in the TanStack supply chain attack, and its GitHub OAuth token was used.
• Approximately 170 private repositories were cloned between 05:52 and 06:01 UTC on May 22, 2026, and the account was removed from the GitHub organization on May 25.
• Email addresses of 83 users, names, email addresses, and investment details of 51 investment candidates, and one restricted AWS SNS token were included in the source code.
• On August 17, the exposed AWS credential was tested using GetCallerIdentity and ListTopics requests, but no further operations were confirmed.
• CrowdSec did not confirm any source code modifications, or compromises of production infrastructure, databases, or CI/CD environments.

Inference

• The combination of a leftover former employee account and a still-valid OAuth token associated with a retained former employee account expanded device compromise into organization-wide source code leakage. Therefore, offboarding and OAuth session management must be treated as part of the same compromise vector alongside dependency controls.

Hypothesis

No additional hypotheses. Unconfirmed items are listed in "Unknowns and Further Investigation".

13. MITRE ATT&CK

• T1195.002 Compromise Software Supply Chain (Confidence: medium): CrowdSec concluded that the TanStack supply chain attack was the initial compromise, but exact package names and versions were not identified.
• T1528 Steal Application Access Token (Confidence: high): A GitHub OAuth token was compromised and used to access private repositories.
• T1550.001 Use Alternate Authentication Material: Application Access Token (Confidence: High): The stolen GitHub OAuth token was used to fetch private repositories.
• T1078.004 Valid Accounts: Cloud Accounts (Confidence: high): GitHub repositories were cloned using valid permissions of an employee account that remained in the organization.

14. Unknowns and Further Investigation

• Exact names, versions, execution times, and devices of TanStack-related packages used in the initial compromise.
• How the GitHub OAuth token was obtained and specific actions executed by the attacker on the device.
• The extent to which leaked source code was redistributed or abused by third parties.
• Whether information other than the AWS SNS token was used in subsequent attacks.

15. Impact on SOCs and Organizations

When development device supply chain compromise, still-valid OAuth token associated with a retained former employee accounts, and leftover former employee accounts are chained together, numerous private repositories can be leaked even without direct compromise of CI/CD environments. In addition to dependency verification, organizations must implement a combined approach of deleting accounts and revoking OAuth authorizations upon departure, detecting rapid mass cloning, and reducing personal data and secrets within source code.

16. Summary by Role

• SOC: Investigate departed user accounts, OAuth tokens, mass GitHub clones, and cloud token usage on the same timeline.
• Administrators: Immediately revoke organization membership and OAuth authorizations during offboarding, and ensure tokens have least privilege and short lifespans.
• Users: Developers who may have run suspicious dependency packages should disconnect their devices, revoke GitHub sessions and tokens, and preserve evidence.