A departed employee's GitHub OAuth token cloned about 170 CrowdSec repositories in nine minutes
CrowdSec's final analysis puts the entry point in a former employee's development environment, hit by the TanStack npm malware in May. Its own organisation audit logs did not keep the clone events, so GitHub Support supplied them.
The Engineer · Build desk
What happened
- CrowdSec's final analysis puts the entry point at a recently departed employee's account and its valid GitHub OAuth token, not the CI/CD API key theft that initial reports described.
- The token cloned about 170 private repositories in the nine minutes between 05:52 and 06:01 UTC on May 22, 2026.
- GitHub support reconstructed the token's lifecycle and tied it to an employee whose organisation membership had been left active temporarily so unfinished work could be completed; the account came out on May 25.
- CrowdSec's standard organization audit logs did not retain the Git activity, and GitHub Support later supplied the two-hour window that showed the repository fetches.
Why it matters
- What it limits constraint CrowdSec recommends detecting and blocking rapid cloning of many repositories. An organisation keeping only the standard GitHub audit logs cannot build that alert from its own data, and has to ask the vendor for the events after the fact.
- Who has to decide decision A leaver checklist that stops at directory membership leaves the third-party grant standing, and CrowdSec's own list separates organisation removal, OAuth app revocation and invalidation of existing tokens into three actions.
- What doesn't add up contradiction One account counts about 170 private repositories while the other describes private code alongside more than 130 repositories that were already public, so a reader cannot tell whether the public ones sit inside that 170 or on top of it.
Next story · Security · Oct 6
Malicious indexed-btree package moves npm malware from install scripts to first useConfirmed2 publishers
About 170 repositories in nine minutes is roughly 19 clones a minute, held for the whole window, from a single IP address in Toronto [26][3]. CrowdSec attributes the TanStack compromise to TeamPCP, which it also tracks as UNC6780, and ties the repository downloads to an actor named diencracked in Git metadata found inside the leaked archive [23].
The malicious npm versions were published on May 11, and the clone ran 11 days later [27]. Detection came from outside the company: an archive appeared on an online forum, CrowdSec was alerted on September 16, 117 days after the fetches, and it rotated remaining credentials and tokens before publishing an initial statement the next day [12][25].
Offboarding had partly run. CrowdSec said the employee's access to core infrastructure was already revoked, and cited that as a reason no suspicious activity showed up in its cloud environment [8]. The organisation membership that remained held read permissions on private repositories [6]. Three days separated the clone from the account's removal [24].
One AWS credential in the leaked code was still live, scoped to a role permitted to publish to a single SNS topic [9]. On August 17 someone called GetCallerIdentity and ListTopics with it. Those are the two calls you make when you hold a key and do not know what it opens. Both requests appear in CloudTrail, and CrowdSec reported no activity after that [10].
The archive also held 83 user email addresses and the names, emails and investment context of 51 potential investors from 2020 [16][18]. CrowdSec said the 83 belonged to its data science team's project monitoring and statistics work and amounted to less than 0.05 per cent of roughly 150,000 users [17]. 83 divided by 150,000 is about 0.055 per cent [28]. Its audit found no commits, no code changes and no access to production infrastructure, databases or build pipelines [11].
Whether this transfers to another team depends on two conditions: an affected TanStack version installed during the May 11 exposure window, and a developer machine holding an OAuth grant with organisation read. TanStack said attackers used a GitHub Actions configuration weakness, poisoned shared workflow caches and a publishing token pulled from runner memory to push 84 malicious versions across 42 packages in the Router and Start repository [19]. The malware collected GitHub tokens, npm credentials, cloud secrets, Kubernetes and Vault tokens and SSH private keys [20], and TanStack told anyone who installed during the window to treat the environment as compromised and rotate what it could reach [21]. CrowdSec said the exact package and version that ran on the employee's device have not been identified [22].
What to watch
- Whether CrowdSec names the TanStack package and version that ran on the employee's device, which would let other teams check lockfiles against the May 11 window.
- Whether GitHub exposes repository clone and fetch events in organisation audit logs that tenants retain themselves, instead of via a support request.
- Whether the scoped SNS credential shows any activity after the August 17 GetCallerIdentity and ListTopics calls.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption32
- Hype gap−8
- Incentives72
- Confidence58
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
CrowdSec's final analysis concluded the entry point was a recently departed employee's account and its GitHub OAuth token, not the CI/CD API key theft suggested in initial reports.
- [2]
Between 05:52 and 06:01 UTC on May 22, 2026, the token was used to clone about 170 private repositories in about nine minutes.
- [3]
The repositories were downloaded on May 22, between 05:52 and 06:01 UTC, from an IP address in Toronto, according to CrowdSec's forensic review.
- [4]
CrowdSec said the copied material included private source code alongside more than 130 repositories that were already public.
- [5]
GitHub support reconstructed the lifecycle of the OAuth token used for the cloning and linked the access to an employee who had just left the company but whose GitHub organisation membership had remained active temporarily to allow unfinished work to be completed; the account was removed from the organisation on May 25.
- [6]
A former employee account remained in the CrowdSec GitHub organization, with the token holding read permissions for private repositories.
- [7]
CrowdSec removed the account from its GitHub organization on May 25.
- [8]
CrowdSec said the employee's access to core infrastructure had already been revoked, which it cited as a reason no suspicious activity was found in its cloud environment.
- [9]
One scoped AWS credential associated with a role permitted to publish to a single SNS topic was exposed in the leaked code.
- [10]
On August 17 the exposed AWS credential was tested using GetCallerIdentity and ListTopics requests, which appear in AWS CloudTrail; CrowdSec reported no further activity.
- [11]
CrowdSec's audit found no commits, code changes or modifications to continuous-integration systems, and no evidence that production infrastructure, databases or build pipelines were accessed.
- [12]
CrowdSec was alerted to the source-code exposure on September 16 after an archive was published on an online forum; it assembled an incident-response team, began forensic work and rotated remaining credentials and tokens before publishing an initial statement the following day, with a fuller technical analysis on September 18.
- [13]
CrowdSec's standard organization audit logs did not retain the relevant Git activity; GitHub Support later provided activity for the identified two-hour window, revealing the repository fetches.
- [14]
CrowdSec's remediation list includes removing accounts from the GitHub organization upon departure, revoking OAuth app authorizations, and invalidating existing tokens.
- [15]
CrowdSec's remediation list also includes minimizing OAuth token permissions and lifespans, and detecting and blocking rapid cloning of many repositories.
- [16]
CrowdSec reported that email addresses of 83 users were included in the source code, and no leaks of passwords or customer logs were confirmed.
- [17]
CrowdSec said the 83 email addresses were used by its data-science team for project monitoring and statistical work, representing less than 0.05 per cent of roughly 150,000 users.
- [18]
CrowdSec said names, email addresses and investment-related context concerning 51 potential investors from 2020 were included in the material.
- [19]
TanStack said attackers exploited a GitHub Actions configuration weakness, poisoned shared workflow caches and extracted a publishing token from runner memory, allowing 84 malicious versions across 42 packages in the TanStack Router and Start repository to be published to npm on May 11.
- [20]
The affected packages carried credential-stealing malware capable of harvesting GitHub tokens, npm credentials, cloud-service secrets, Kubernetes and Vault tokens and SSH private keys.
- [21]
TanStack advised users who installed affected versions during the exposure window to treat those environments as compromised and rotate accessible credentials.
- [22]
CrowdSec said the exact package name and version used in the compromise have not been identified, and the execution device has not been made public.
- [23]
Threat actor attribution: TeamPCP / UNC6780 for the TanStack supply chain compromise according to CrowdSec; diencracked for the repository downloads according to leaked Git metadata analyzed by CrowdSec.
- [24]
Three days passed between the May 22 cloning and the May 25 removal of the account from the GitHub organisation.
- [25]
117 days passed between the May 22 cloning and CrowdSec being alerted to the exposure on September 16.
- [26]
Cloning about 170 repositories in about nine minutes is roughly 19 repositories a minute.
- [27]
Eleven days passed between the May 11 publication of the malicious TanStack versions to npm and the May 22 cloning.
- [28]
83 addresses out of roughly 150,000 users is about 0.055 per cent, slightly above the 'less than 0.05 per cent' figure CrowdSec gave.
Sources
2 independent publishers whose own reporting we read for this story.
- dev.toCrowdSec Source Code Leak: GitHub OAuth Token Abused in TanStack Supply Chain Attack
1 article · September 22, 2026
- CrowdSec traces repository theft to TanStack compromise — Arabian Post
thearabianpost.com
1 article · September 20, 2026
Topics and entities
Topics
- Software Supply Chain Security
- Incident response and external forensics
- OAuth token security
- Identity Offboarding
- npm Ecosystem Security
- Source code leaks
Entities
- TeamPCP / UNC6780
- SecurityWeek
- Amazon Web Services
- CrowdSec
- npm registry
- GitHub
- TanStack