Build2 publishers2 min readPublished
A departed employee's GitHub OAuth token cloned about 170 CrowdSec repositories in nine minutes
CrowdSec's final analysis puts the entry point in a former employee's development environment, hit by the TanStack npm malware in May. Its own organisation audit logs did not keep the clone events, so GitHub Support supplied them.
The Engineer · Build desk
What happened
- CrowdSec's final analysis puts the entry point at a recently departed employee's account and its valid GitHub OAuth token, not the CI/CD API key theft that initial reports described.
- The token cloned about 170 private repositories in the nine minutes between 05:52 and 06:01 UTC on May 22, 2026.
- GitHub support reconstructed the token's lifecycle and tied it to an employee whose organisation membership had been left active temporarily so unfinished work could be completed; the account came out on May 25.
- CrowdSec's standard organization audit logs did not retain the Git activity, and GitHub Support later supplied the two-hour window that showed the repository fetches.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- constraint CrowdSec recommends detecting and blocking rapid cloning of many repositories. An organisation keeping only the standard GitHub audit logs cannot build that alert from its own data, and has to ask the vendor for the events after the fact.
- decision A leaver checklist that stops at directory membership leaves the third-party grant standing, and CrowdSec's own list separates organisation removal, OAuth app revocation and invalidation of existing tokens into three actions.
- contradiction One account counts about 170 private repositories while the other describes private code alongside more than 130 repositories that were already public, so a reader cannot tell whether the public ones sit inside that 170 or on top of it.
About 170 repositories in nine minutes is roughly 19 clones a minute, held for the whole window, from a single IP address in Toronto [1][3]. CrowdSec attributes the TanStack compromise to TeamPCP, which it also tracks as UNC6780, and ties the repository downloads to an actor named diencracked in Git metadata found inside the leaked archive [23].
The malicious npm versions were published on May 11, and the clone ran 11 days later [3]. Detection came from outside the company: an archive appeared on an online forum, CrowdSec was alerted on September 16, 117 days after the fetches, and it rotated remaining credentials and tokens before publishing an initial statement the next day [22][4].
Offboarding had partly run. CrowdSec said the employee's access to core infrastructure was already revoked, and cited that as a reason no suspicious activity showed up in its cloud environment [9]. The organisation membership that remained held read permissions on private repositories [7]. Three days separated the clone from the account's removal [2].
One AWS credential in the leaked code was still live, scoped to a role permitted to publish to a single SNS topic [12]. On August 17 someone called GetCallerIdentity and ListTopics with it. Those are the two calls you make when you hold a key and do not know what it opens. Both requests appear in CloudTrail, and CrowdSec reported no activity after that [13].
The archive also held 83 user email addresses and the names, emails and investment context of 51 potential investors from 2020 [14][16]. CrowdSec said the 83 belonged to its data science team's project monitoring and statistics work and amounted to less than 0.05 per cent of roughly 150,000 users [15]. 83 divided by 150,000 is about 0.055 per cent [6]. Its audit found no commits, no code changes and no access to production infrastructure, databases or build pipelines [21].
Whether this transfers to another team depends on two conditions: an affected TanStack version installed during the May 11 exposure window, and a developer machine holding an OAuth grant with organisation read. TanStack said attackers used a GitHub Actions configuration weakness, poisoned shared workflow caches and a publishing token pulled from runner memory to push 84 malicious versions across 42 packages in the Router and Start repository [17]. The malware collected GitHub tokens, npm credentials, cloud secrets, Kubernetes and Vault tokens and SSH private keys [18], and TanStack told anyone who installed during the window to treat the environment as compromised and rotate what it could reach [19]. CrowdSec said the exact package and version that ran on the employee's device have not been identified [20].
What to watch
- Whether CrowdSec names the TanStack package and version that ran on the employee's device, which would let other teams check lockfiles against the May 11 window.
- Whether GitHub exposes repository clone and fetch events in organisation audit logs that tenants retain themselves, instead of via a support request.
- Whether the scoped SNS credential shows any activity after the August 17 GetCallerIdentity and ListTopics calls.