Hackers Exploit TanStack Supply Chain Attack to Steal 170 Private CrowdSec Repositories
CrowdSec says TeamPCP cloned about 170 repositories using a GitHub token stolen in the TanStack npm compromise.
CrowdSec said attackers linked to the May TanStack npm compromise, attributed to TeamPCP (UNC6780), used a stolen GitHub OAuth token from a former employee's lingering account to clone about 170 repositories, including private source. On May 11 the group backdoored 42 TanStack packages with Shai Hulud credential-harvesting malware; the clones occurred on May 22 and were publicly disclosed on September 16. Exposed material included console and detection code, emails for 83 users, 2020 investor contacts, and one restricted AWS SNS credential that an actor tested on August 17. CrowdSec said production infrastructure, customer databases, CI/CD pipelines, and open-source code were not altered.
- TeamPCP, also tracked as UNC6780, backdoored 42 TanStack npm packages with Shai Hulud on May 11.
- A former employee's GitHub OAuth token was used on May 22 to clone about 170 CrowdSec repositories.
- The leak included source code, 83 user emails, 2020 investor contacts, and one limited AWS SNS credential.
- CrowdSec said production systems, customer databases, CI/CD, and open-source code were not modified.
- The exposure was publicly disclosed on September 16, months after the May access.
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1528 Steal Application Access TokenT1078 Valid AccountsT1213.003 Code Repositories
- Products
- npm
- Malware
- Shai Hulud
- Victims
- CrowdSec
- Organizations
- CrowdSecGitHubGitGuardianAikidoFuites Info
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 23.234.84.102 | ed actor tested the credential on August 17 from IP address 23.234.84.102, attempting AWS GetCallerIdentity and ListTopics requests a |
From the original article
3 min read at gbhackers.com
Threat actors linked to the TanStack npm supply chain compromise allegedly used a stolen GitHub OAuth token to clone about 170 private CrowdSec repositories, exposing source code, limited contact information, and a restricted AWS notification credential. CrowdSec stated that the compromise originated from a former employee’s account, which remained in the company’s GitHub organization for […]
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.