On May 22, an attacker authenticated as a CrowdSec employee who had already left the company and copied about 170 private GitHub repositories. CrowdSec disclosed the theft on September 18. The laptop had been compromised in May’s TanStack npm supply chain attack, which stole developer credentials from machines that installed malicious package versions. GitHub access stayed live after the person walked out. That leftover identity is the cybersecurity failure you should put on your offboarding clock today.

Departed Engineer Still Held GitHub Access on May 22

CrowdSec, a French security vendor, published the timeline itself. An employee left. Organization access on GitHub stayed attached to his account. On May 22, that login cloned roughly 170 private repositories.

Private GitHub is where your real operating model lives. Detection rules you have not shipped. CI wiring. Infrastructure modules. Customer-specific branches. When 170 repos leave, assume the attacker can reconstruct how you build, who you integrate with, and which secrets were committed years ago and later “fixed” with a follow-up commit that never purged git history.

The clone used a still-valid identity. GitHub will serve private git objects to a personal access token, an SSH key, or a browser session that still belongs to an org member. Your firewall sees TLS to github.com, which you already allow from engineering networks and home VPNs all day. Brute-force noise never shows up on that path. Valid sessions do not look like attacks in edge logs.

CrowdSec kept the account enrolled. Plenty of teams disable the directory user, collect the laptop, and skip the forges. GitHub membership, classic PATs, fine-grained tokens, deploy keys, authorized GitHub Apps, and Codespaces secrets are separate objects. Closing Okta or Entra does not revoke a PAT minted during an outage in 2024.

If you own cyber security for a product org, treat every leaver as still holding one live forge credential until an export says otherwise. Pull members, pending invites, tokens, SSH keys, and apps. Match them to HR last-day dates. An access ticket marked complete is a story. The GitHub API response is evidence.

TanStack npm Theft Harvested Credentials Before Offboarding Caught Up

CrowdSec says the laptop was hit in the TanStack npm campaign. Malicious package versions ran in the developer environment and stole credentials. Then the engineer exited. Stolen GitHub material kept working because revocation never happened.

That order should change how you rank threat-protection work this quarter. npm and friends execute as the user. They can read the GitHub CLI config, SSH keys, .npmrc files, browser cookies, and cloud CLIs. Perimeter tools still allow registry.npmjs.org and github.com because development dies without them. Defense in depth that only hardens the edge leaves the workstation as a factory for reusable secrets.

Stolen credentials remain a leading initial access path in Verizon’s DBIR reporting. Identity visibility is the boring prerequisite: list humans, machines, and tokens, including the ones living in SaaS forges rather than your directory. Cloud and multicloud already splinter that list. GitHub organizations add another plane with its own admins, its own logs, and its own idea of disabled.

You also do not get weeks. Other reporting this week described AI-assisted exploit development shrinking the window between a CVE disclosure and a working attack. Token replay is shorter still. A PAT is useful the second it is copied. Quarterly access reviews document the last quarter. Same-day revoke-and-rotate is the control that would have stopped a May 22 clone of a leaver’s org.

Revoke Developer Tokens on a Same-Day Offboarding Clock

Treat SCM offboarding as incident response. Leftover GitHub access is a delayed data-theft bug in your joiner-mover-leaver process. A backup owner should be able to run this without waiting for the laptop to come home.

Do the immediate work the same calendar day the person is terminated or resigns:

• Disable the identity in the IdP, then revoke GitHub org membership, PATs, SSH keys, deploy keys, and GitHub App authorizations for that user before the day ends.
• Rotate every secret that person could have read: CI variables, signing keys, npm and PyPI tokens, cloud access keys, and webhook secrets in private repos.
• Force a credential sweep on remaining engineering laptops: GitHub CLI stores, git credential helpers, SSH agents, and browser sessions to the forge.
• Search clone, fork, and audit-log events for mass private-repo access, especially from new IPs, new keys, and accounts in a pre-departure or post-departure window.

Standing security hardening belongs in the same program. Require SSO and SAML for the GitHub org, disable classic PATs where the product lets you, expire fine-grained tokens, and retire SSH keys that are not hardware-backed. Stream audit logs into the same pipeline you use for threat detection. Alert on a user leaving the org and then succeeding at git traffic, and on bursts of private repository clones. Review org owners on a calendar. Review tokens continuously.

If you cannot name the owner of a deploy key tonight, schedule a break-glass rotation. Keys without owners are pre-stolen credentials. Contractors, interns, acquired-company seats, and the shared ci-bot user that six people still have in their agent are leavers that never got an HR ticket. Shared bots keep working after humans resign. Hunt those first.

Leftover SCM Identity Is a Cybersecurity Detection Gap

Your incident response plan for a stolen laptop probably includes isolate, wipe, and password reset. Add a forge-specific appendix. Confirm whether private repositories were cloned, forked, or downloaded as archives. Once git clone succeeds, treat the contents as gone. That changes legal notification, customer-commit review, and whether you rotate only “likely touched” secrets or everything in that org.

Detection is ugly because the traffic looks like work. A clone over 443 to GitHub from a home IP the engineer used last week will not trip DLP. You need identity telemetry on one timeline: GitHub audit logs, IdP leaver events, MDM returned-or-wiped status, and npm or token creation. If those systems do not share a clock and a case ID, you will learn about the clone from a reporter, the way CrowdSec had to explain a May event in September.

Spend on the list before you spend on another dashboard. Name human users, machine users, tokens, and keys. Map them to employment status. Alert when a leaver’s identity still authenticates. That is identity visibility as an operational control. A prettier console will not revoke the PAT. If your defense in depth diagram still shows the forge inside a trusted bubble behind the firewall, reprint the diagram. GitHub is an internet service that holds your source. Treat it that way on the day someone resigns.

Sources

• CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories
• Identity Visibility in 2026: The Foundation of Identity Security
• Can You Prove a New CVE Is Exploitable Before Attackers Do?