GitHub OAuth token mass repo clone from new location (TanStack/Shai Hulud)

Arnold Chan@slaz

•updated Sep 19, 2026•0•0•8

Detects rapid mass-cloning or downloading of private GitHub repositories shortly after an OAuth token authorization, originating from IP addresses or countries not previously associated with the user account. This behavior is indicative of unauthorized bulk data extraction using compromised credentials, consistent with threat actor activity (e.g., TeamPCP/UNC6780).