TANSTACK NPM SUPPLY CHAIN ATTACK EXPOSES 170 PRIVATE CROWDSEC GITHUB REPOSITORIES

Summary from the TLDR InfoSec newsletter

Attackers used a former CrowdSec employee's GitHub OAuth token following the May TanStack compromise. On May 22, they cloned about 170 private repositories within nine minutes. The leaked archive contained private code and contact data for 83 users. Investigators found no code changes, CI/CD access, or AWS access. The attackers tested one scoped SNS credential, but IAM permissions blocked it.