Shai-Hulud Attack Nips Cyber-Firm CrowdSec's GitHub Data
Attackers stole 170 CrowdSec private GitHub repositories using an OAuth token taken in the TanStack npm supply-chain attack.
73
Victim
CrowdSec
- Mentions · 7d0
- Mentions · 30d0
- All mentions5
- First seenSep 19, 2026
- Last mentionedSep 22, 2026
Timeline
5 articles · newest firstCrowdSec Confirms Source Code Stolen in Supply Chain Attack
CrowdSec confirmed attackers stole source code from roughly 300 GitHub repositories via the May 2026 TanStack supply chain attack; no customer data affected.
58
Hackers Exploit TanStack Supply Chain Attack to Steal 170 Private CrowdSec Repositories
CrowdSec says TeamPCP cloned about 170 repositories using a GitHub token stolen in the TanStack npm compromise.
73
TanStack Supply Chain Attack Lets Hackers Steal 170 Private CrowdSec GitHub Repositories
Attackers used an OAuth token stolen in the TanStack npm supply chain attack to clone 170 private CrowdSec GitHub repositories, later leaked on a forum.
70
CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories
CrowdSec says the TanStack npm supply chain attack let an attacker copy 170 private GitHub repos via a former employee's retained account.
74
Related CVEs
by mentions- CVE-2026-453213%9.6Supply chain compromise: credential-stealing code in 42 @tanstack/* npm packages
Appears with
- GitHubvendor · 4
- TanStackvendor · 4
- CrowdSecorganization · 4
- CrowdSecvendor · 3
- GitHuborganization · 3
- AWSvendor · 2
- npmproduct · 2
- TanStackorganization · 1
- GitHub OAuth tokenproduct · 1
- OpenAIvendor · 1
- Shai Huludmalware · 1
- TeamPCPthreat actor · 1
- Mistral AIvendor · 1
- TeamPCPvendor · 1
- Aikidoorganization · 1
- GitGuardianorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.