[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$flqGx5C2PtOhYGCW6vpv7yZjyiwV3OxgGZahQSDzOKVk":3},{"article":4,"iocs":57},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":32,"category":33,"article_tags":36},"94484969-da36-4cec-be6b-fb836fb83448","Shai-Hulud Attack Nips Cyber-Firm CrowdSec's GitHub Data","shai-hulud-attack-nips-cyber-firm-crowdsec-s-github-data-5778eb","Threat actors stole 170 private repositories using an OAuth token stolen from a former employee's computer through the TanStack npm supply chain attack.","The Shai-Hulud threat actor has compromised CrowdSec's GitHub repositories, stealing 170 private repositories. The attackers exploited a compromised OAuth token, which was obtained from a former employee's computer. This access was facilitated by the TanStack npm supply chain attack, highlighting the risks associated with open-source dependencies.","Shai-Hulud attack steals 170 private GitHub repos from CrowdSec via compromised OAuth token.",null,"https:\u002F\u002Fwww.darkreading.com\u002Fcyberattacks-data-breaches\u002Fshai-hulud-attack-cyber-firm-crowdsec-github-data","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fblt69385daa466aeca3\u002F6ab2586609bf6b1d17c9b926\u002Fsandworms_FlixPix_Alamy.png?width=720&quality=80&disable=upscale","2026-09-22T17:32:49+00:00","2026-09-22T18:00:50.816323+00:00",8,[18,21,24,27,30],{"name":19,"type":20},"Shai-Hulud","threat_actor",{"name":22,"type":23},"CrowdSec","vendor",{"name":25,"type":26},"GitHub","product",{"name":28,"type":29},"OAuth","technology",{"name":31,"type":29},"npm","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":32,"icon":11,"name":34,"slug":35},"Breaches","breaches",[37,42,47,52],{"category":38},{"id":39,"icon":11,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":44,"icon":11,"name":45,"slug":46},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":48},{"id":49,"icon":11,"name":50,"slug":51},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":53},{"id":54,"icon":11,"name":55,"slug":56},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[58],{"type":59,"value":19,"context":60},"malware","Threat actor name associated with the attack"]