CrowdSec Repositories Compromised via Stolen GitHub OAuth Token in Supply Chain Attack In a supply chain attack linked to the TanStack npm compromise, threat actors TeamPCP (UNC6780) exploited a stolen GitHub OAuth token to clone 170 private CrowdSec repositories, exposing source code, limited user contact details, and a restricted AWS credential. The breach originated from a former employee’s GitHub account, which remained active for transition purposes. The account was compromised in May, with unauthorized access occurring between 05:52 and 06:01 UTC on May 22. CrowdSec removed the account three days later but did not disclose the incident publicly until September 16. The attackers, who backdoored 42 npm packages with the Shai Hulud malware on May 11, used the stolen OAuth token to download repositories from an IP address in Toronto, Canada. The cloned data included 130+ public and private repositories, containing CrowdSec’s SaaS console code, automation tools, and Consensus Algorithm though no sensitive customer data or production infrastructure was accessed. While the exposed code could help adversaries identify vulnerabilities, CrowdSec stated that its Consensus Algorithm which determines IP blocklist additions relies on distributed security engines, making manipulation difficult. The company also confirmed that no malicious commits or infrastructure changes occurred. A still-valid AWS SNS credential in the leaked archive was tested on August 17 from an unidentified IP, but its restricted permissions prevented further exploitation. The breach also exposed email addresses of 83 users (less than 0.05% of CrowdSec’s user base) and investor details from 2020, prompting notifications to affected individuals. CrowdSec responded by rotating credentials, revoking tokens, and conducting forensic reviews, with assistance from GitHub, GitGuardian, Aikido, and Fuites Info. The incident highlights risks in developer credential exposure and the need for stricter offboarding controls and faster incident response.