Shai-Hulud Attack Nips Cyber-Firm CrowdSec's GitHub Data
Attackers stole 170 CrowdSec private GitHub repositories using an OAuth token taken in the TanStack npm supply-chain attack.
Dark Reading reports that attackers stole 170 private GitHub repositories belonging to security firm CrowdSec. The theft used an OAuth token taken from a former employee's computer during the TanStack npm supply-chain compromise associated with the Shai-Hulud attack. The incident shows how a developer token exposed through a package-ecosystem attack can unlock an organization's private source code.
- Attackers stole 170 private CrowdSec GitHub repositories.
- An OAuth token was taken from a former employee's computer.
- The token came from the TanStack npm supply-chain attack.
- The theft is tied to the Shai-Hulud supply-chain campaign.
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1528 Steal Application Access TokenT1550.001 Application Access TokenT1213.003 Code Repositories
- Malware
- Shai-Hulud
- Victims
- CrowdSec
From the original article
Threat actors stole 170 private repositories using an OAuth token stolen from a former employee's computer through the TanStack npm supply chain attack.
By Elizabeth Montalbano · darkreading.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.