Shai-Hulud Attack Nips Cyber-Firm CrowdSec's GitHub Data

1. Executive summary

Threat actors copied approximately 170 of CrowdSec's private GitHub repositories on 22 May 2026, using the GitHub account of a recently departed employee whose access had not been revoked. CrowdSec attributes the initial compromise of that employee's laptop to the May 2026 TanStack npm supply chain attack, in which malicious package versions stole credentials from developer machines. The actor is publicly referred to as "Shai-Hulud"; this attribution has no MITRE ATT&CK profile and must be treated as unconfirmed. The impact is source-code and intellectual-property theft at a security vendor whose tooling is deployed inside client environments, not direct compromise of CrowdSec's production infrastructure. For EMEA financial services the exposure runs through the supply chain: source disclosure may reveal implementation detail for security tooling that clients operate, and the incident is a concrete demonstration that npm dependency compromise plus dormant employee credentials defeats code-hosting access controls.

2. Regulatory framing

No other article in the provided regulatory reference is specifically engaged. The incident occurred at CrowdSec, not at a financial entity, so DORA Art. 19 reporting of major ICT-related incidents is not triggered for clients by this item alone; that assessment changes only if a client confirms compromise of its own developer environment through the same TanStack vector.

3. Technical analysis & attack chain

Confirmed steps, as reported by CrowdSec and corroborated across the three sources:

1. In May 2026, malicious versions of TanStack npm packages were published as part of a supply chain attack. CrowdSec states that a departing employee's laptop was compromised through this vector.
2. The malicious package versions stole credentials from the compromised developer machine. The credential material included an OAuth token usable against GitHub.
3. CrowdSec had left the former employee's GitHub access open after his departure. The attacker therefore held valid, unrevoked credentials for a legitimate account with read access to private repositories.
4. On 22 May 2026, the attacker used that account to copy approximately 170 private GitHub repositories belonging to CrowdSec.
5. CrowdSec publicly disclosed the incident on 18 September 2026, nearly four months after the exfiltration.

Technical specifics available in the source material are limited to the above. The sources do not state which TanStack packages were trojanised, what the credential-stealing payload was named, how the OAuth token was captured (browser session, keychain, environment variable, or configuration file), whether the attacker used the GitHub web interface or an API/git client, or what was done with the copied repositories after exfiltration. No ransomware, extortion demand, or follow-on intrusion into CrowdSec production systems is reported.

Context from the wider campaign: the June 2026 "Mini Shai-Hulud" wave described by Help Net Security and Wiz Security compromised over 30 Red Hat Cloud Services npm packages, published 1 June 2026 in two bursts (10:53 to 10:53:33 UTC and 13:44 to 13:46:47 UTC), after a specific Red Hat employee GitHub account was compromised and used to push malicious orphan commits. That wave targeted credentials stored in developers' build environments, the same objective as the TanStack attack that hit CrowdSec. This establishes a pattern of npm supply chain attacks harvesting developer credentials and then using them to access source hosting, but the Red Hat incident is a separate event and there is no evidence in the sources linking the same operators to both.

Attribution caveat: "Shai-Hulud" has no MITRE ATT&CK profile in the verified reference data, so attribution is unconfirmed. The link between the CrowdSec exfiltration and the TanStack campaign rests on CrowdSec's own investigation and is single-sourced; no second party has independently corroborated the mechanism. Treat the attack chain above as vendor-reported until independent technical detail (package names, token theft mechanism, GitHub audit log evidence) is published.

4. Mitigation & containment

P1, within 24 hours:

• Inventory every GitHub (and equivalent Git hosting) account belonging to leavers and long-term inactive users. Revoke all OAuth tokens, personal access tokens, and SSH keys for accounts with no active employment relationship. The CrowdSec exfiltration succeeded solely because a departed employee's access remained valid.
• If your organisation consumed TanStack npm packages in May 2026, or any Red Hat Cloud Services npm packages published 1 June 2026, identify the developer machines that installed them and treat those machines as potentially credential-compromised. Rotate all credentials present on them: browser-stored sessions, password manager vaults, cloud CLI credentials, package registry tokens, and source-hosting tokens.
• Pull GitHub audit logs for the period since 1 May 2026 and search for repository clone, fork, archive, and download events on private repositories performed by accounts that should not have been active. The CrowdSec attacker's action would appear in audit logs as bulk private repository access by a dormant account.

P2, within 72 hours:

• Enforce organisation-wide token hygiene on GitHub: set maximum lifetimes for personal access tokens and OAuth tokens, require organisation approval for OAuth app installations, and enable automatic revocation of tokens on member removal. Verify that offboarding checklists include source-hosting access as a mandatory, verifiable step rather than a manual reminder.
• Restrict npm installs in developer environments to verified registry sources and enable lockfile enforcement so builds cannot silently pull a newly published malicious version. Pin TanStack and other build-tool dependencies by exact version and integrity hash.
• Review whether secrets, private keys, or client-specific configuration exist inside any private repository. If they do, assume they are recoverable by anyone who copied the repository and rotate them; repository-level access controls do not protect secrets once the repository itself is exfiltrated.

P3, within 7 days:

• Ask CrowdSec, through your third-party risk process, for written confirmation of which of the 170 repositories contained code or configuration deployed in your environment, and whether any client-specific material was included.
• Add dormant-account access to private repositories as a specific test scenario in your next threat-led penetration test or red team exercise, since it is now a demonstrated attack path against a security vendor.

5. Indicators of compromise

No indicators of compromise available in the source material.

The sources describe observable behaviours relevant to detection but provide no atomic indicators (no package names, file hashes, domains, or IP addresses).

Behavioural indicators

6. Detection

Insufficient indicators to author detection rules.

The sources contain no package names, file names, command-line strings, registry keys, mutexes, or hard-coded values attributable to the malicious TanStack packages or the credential-stealing payload. A rule built from the strings available (product names, actor name, vendor headlines) would detect reporting about the attack rather than the attack itself, so none is emitted. Revisit this section if CrowdSec or the npm security community publishes package names or hashes for the trojanised TanStack versions.

7. Sources

• Dark Reading, "Shai-Hulud Attack Nips Cyber-Firm CrowdSec's GitHub Data", https://www.darkreading.com/cyberattacks-data-breaches/shai-hulud-attack-cyber-firm-crowdsec-github-data, 22 September 2026
• The Hacker News, "CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories", https://thehackernews.com/2026/09/crowdsec-says-tanstack-npm-attack-led.html, September 2026
• SecurityWeek, "CrowdSec Confirms Source Code Stolen in Supply Chain Attack", https://www.securityweek.com/crowdsec-confirms-source-code-stolen-in-supply-chain-attack/, September 2026
• Help Net Security, "Red Hat npm packages compromised in new Mini Shai-Hulud malware wave", https://www.helpnetsecurity.com/2026/06/02/red-hat-npm-packages-compromised-mini-shai-hulud/, 2 June 2026

8. Adverse Trace position

We assess this as a supply chain and identity-hygiene failure with source-code disclosure impact at a security vendor, not as a vulnerability requiring emergency patching, and the severity for most EMEA financial services clients is moderate and indirect: the direct loss is CrowdSec's, but the incident demonstrates an attack path (npm credential theft plus unrevoked leaver access) that is common across the sector and cheap to fix. The attribution to Shai-Hulud is unconfirmed, and the mechanism linking the TanStack compromise to the GitHub exfiltration is single-sourced to CrowdSec's own investigation; we will not treat the chain as proven until independent technical detail is published. Clients should act on the P1 items regardless of how the attribution resolves, because dormant-account access to private repositories is a confirmed exfiltration vector here and needs no further corroboration to justify revocation. We will monitor for publication of the trojanised TanStack package names and hashes, any CrowdSec disclosure of repository contents, and any evidence of follow-on use of the stolen source, and we will update this advisory if indicators become available.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.