Earlier this year, attackers leveraged a stolen GitHub OAuth token to clone roughly 170 private repositories belonging to CrowdSec after a supply‑chain compromise of TanStack packages. The breach was only discovered when the code appeared on a dark‑web forum in mid‑September, exposing a token, a handful of email addresses, and investor details.
Root cause and timeline
The chain began with the TeamPCP group deploying the Mini Shai‑Hulud worm against the npm ecosystem, injecting 84 malicious artifacts into 42 TanStack packages. The worm harvested credentials, including an OAuth token tied to a former CrowdSec employee’s GitHub account that still retained read access to the organization’s private inventories. The token enabled the ex‑employee’s laptop to dump the repositories before the account was revoked three days later. The stolen code surfaced on the pwnforum marketplace on September 16, confirming the leak.
Operational gaps revealed
Two operational shortcomings emerged:
- Delayed off‑boarding revocation. Access to the former employee’s GitHub account remained active for days after departure, allowing the token to be abused.
- Missing endpoint detection and response (EDR) on developer workstations. CrowdSec admitted that developer machines lacked EDR at the time, a gap now being addressed.
Both issues align with broader industry findings that off‑boarding is a frequent breach vector and that endpoint visibility is critical for detecting credential‑theft techniques.
Architectural considerations for token handling
While CrowdSec already employs privilege separation, two‑factor authentication, audit logging, penetration testing, automated code analysis, and npm node age monitoring, the incident highlights specific token‑management practices that merit review:
- Ensure OAuth tokens are scoped to the minimum required permissions and have short lifetimes where possible.
- Automate revocation of all tokens associated with an identity immediately upon termination.
- Integrate secret‑rotation pipelines that detect and rotate exposed credentials, as CrowdSec noted most leaked tokens were already rotated.
- Maintain inventory of tokens used in code repositories and monitor for accidental inclusion in source.
Related CloudNinjas coverage: security.
What This Means For Practitioners
Practitioners should audit their off‑boarding workflows to guarantee instant revocation of all cloud and source‑control credentials. Deploy EDR or comparable endpoint telemetry on developer machines to surface credential‑theft activity. Review OAuth token scopes and lifetimes, and consider automated rotation triggered by any indication of compromise. Finally, treat supply‑chain incidents as a reminder that a single compromised third‑party package can cascade into internal credential exposure.
