Supply‑Chain Breach Exposes 170 Private CrowdSec Repos After OAuth Token Theft

Cybersecurity firm CrowdSec disclosed that threat actors accessed and exfiltrated 170 of its private GitHub repositories after compromising an OAuth token linked to a former employee's workstation. The breach was traced to a supply‑chain attack involving the popular TanStack npm package, which allowed the attackers to harvest credentials from the developer's machine.

Investigators determined that the malicious code injected into the TanStack package was designed to capture authentication tokens stored on the compromised system. When the former employee, who had previously held privileged access to CrowdSec's GitHub organization, ran the tainted package, the embedded payload seized the OAuth token and relayed it to the attackers. Using that token, the actors were able to clone private repositories without triggering standard security alerts.

CrowdSec, a European open‑source security platform that helps organizations detect and mitigate malicious traffic, confirmed that the stolen repositories contained internal tooling, configuration files, and code that had not been publicly released. While the firm has not disclosed the specific content of the repositories, it emphasized that the breach could potentially aid adversaries in developing more effective attacks against CrowdSec's customers.

The incident underscores the growing risk posed by software supply‑chain vulnerabilities, where seemingly innocuous third‑party libraries become vectors for credential theft. TanStack, a widely used collection of UI components and utilities for JavaScript applications, has faced scrutiny after this episode, prompting calls for stricter vetting processes and automated integrity checks for npm packages.

Security experts note that OAuth tokens, which grant delegated access to services like GitHub, are a high‑value target for attackers. Best practices recommend rotating tokens regularly, employing hardware‑based security modules, and limiting token scopes to the minimum required for a given task. In this case, the token appears to have retained broad repository permissions, facilitating the large‑scale data exfiltration.

CrowdSec has taken steps to remediate the breach, including revoking the compromised token, resetting credentials for all affected accounts, and conducting a comprehensive audit of its development environment. The company also announced plans to enhance its supply‑chain monitoring and to collaborate with the npm community on improving package security. As organizations continue to rely on open‑source components, the episode serves as a reminder that robust credential management and supply‑chain vigilance are essential to safeguarding code assets.