The entry point was not GitHub itself. CrowdSec says the former employee's laptop was compromised during May's supply chain attack on TanStack, in which malicious versions of TanStack's npm packages were used to steal credentials. Those stolen credentials then allowed the attacker to authenticate as the departed employee and pull down private code.

Key facts as disclosed:

• Approximately 170 private GitHub repositories were copied.
• The access was made via the account of a former employee whose GitHub permissions remained active after departure.
• The initial compromise is tied to the TanStack npm supply chain attack, where trojanized package versions harvested credentials.
• CrowdSec attributed the repository exfiltration to an attacker operating through that hijacked account.

The incident highlights two recurring themes: the long tail of credential theft from npm supply chain compromises, and the risk of stale access left in place after staff departures. Organizations that consumed the affected TanStack package versions should treat any credentials exposed on developer machines as potentially compromised, and should audit GitHub organization membership for accounts belonging to former personnel.

Source: The Hacker News

Has your organization reviewed GitHub access for former employees and rotated credentials that may have been exposed in the TanStack npm incident?