GitHub threat report

Threat actors leveraging the TanStack npm supply chain compromise obtained a GitHub OAuth token from credential-harvesting malware (Shai Hulud) and used it to clone approximately 170 CrowdSec repositories in May. The breach exposed private source code, AWS credentials, and email addresses of 83 users and 51 investors. The compromised token belonged to a departing employee whose account remained active in CrowdSec's GitHub organization.

• Hackers Exploit TanStack Supply Chain Attack to Steal 170 Privat(opens in a new tab)