CrowdSec: Departing Employee's Unrevoked GitHub Access, Compromised via TanStack npm Attack, Led to Theft of ~170 Private Repos

What Happened

CrowdSec disclosed on September 18 that an attacker copied roughly 170 of its private GitHub repositories on May 22. According to CrowdSec, the access used belonged to an employee who had recently left the company but whose GitHub credentials had not been revoked. The company says the former employee's laptop had been compromised as part of the earlier supply-chain attack on TanStack, in which malicious versions of TanStack's npm packages harvested credentials from affected machines.

Why It Matters

This incident is a reminder that supply-chain compromises don't end when the malicious package is removed — stolen credentials can surface and be abused months later. It also highlights a common and often overlooked gap: offboarding processes that fail to promptly revoke source-control and other system access when an employee departs. For organizations that rely on npm packages in their build or development environments, this is a concrete example of how a single compromised developer machine can cascade into private code and IP exposure, even after the initial attack window has apparently closed.

What Defenders Should Watch For / Do Now

• Audit offboarding procedures to ensure access to GitHub, npm, CI/CD, and other developer tooling is revoked immediately upon employee departure — not on a delayed or manual schedule.
• Review GitHub audit logs for anomalous repository clone/download activity, especially from accounts belonging to former employees or accounts with stale sessions/tokens.
• Inventory npm dependencies (including transitive ones) for exposure to the TanStack supply-chain compromise, and rotate any credentials that may have been present on affected developer machines, even if the compromise was believed to be resolved.
• Treat credential-stealing malware incidents as having a long tail: consider forcing credential rotation and session invalidation for anyone whose machine was potentially exposed, not just at the time of discovery but on an ongoing basis.
• Monitor for use of long-lived personal access tokens or SSH keys tied to departed employees across source control, package registries, and cloud platforms.

Developing Story

Details here come from CrowdSec's own disclosure and reporting by The Hacker News; the full scope of what was accessed within the ~170 repositories and any downstream impact has not been independently detailed. This is net-new intelligence and we will monitor for updates. Read the original report at The Hacker News.