One Ex-Employee's Laptop Exposed 170 Private GitHub Repos

Emily Davis · 2026-09-19

### The Breach That Started With a Laptop Imagine this: an employee leaves your company, but their access to your private code repositories stays open. That's exactly what happened to CrowdSec, a French security firm. On May 22, an attacker used the GitHub account of a recently departed employee to copy about 170 private repositories. CrowdSec only disclosed the breach on September 18, months after the fact. The employee's laptop had been compromised in a supply chain attack on TanStack, where malicious npm packages stole credentials. ### How a Single Compromised Laptop Led to a Massive Data Theft This isn't just a story about one company's mistake. It's a wake-up call for every organization that relies on third-party code and forgets to revoke access when someone leaves. Let's break down what happened and what you can learn from it. - **The attack vector:** Malicious versions of TanStack's npm packages were published, and they silently harvested credentials from developers' machines. The former CrowdSec employee had one of those packages installed, and his laptop became a gateway. - **The oversight:** CrowdSec didn't revoke his GitHub access after he left. That oversight gave the attacker a direct path into the company's private code. - **The delay:** The breach occurred in May, but CrowdSec didn't announce it until September. That's a long time for stolen code to circulate. ### Why This Matters for Your Business If you think this can't happen to you, think again. Supply chain attacks are on the rise, and they often exploit the smallest gaps—like an old laptop with lingering access. Here's what you can do to protect yourself: - **Revoke access immediately** when an employee leaves. Don't wait for offboarding paperwork. - **Use least privilege** so even if an account is compromised, the damage is limited. - **Monitor for suspicious activity** on your repositories. Unusual cloning or downloading should trigger alerts. - **Educate your team** about the risks of installing packages from untrusted sources. > "The most dangerous phrase in security is 'we'll get to it later.'" — Anonymous ### The Bigger Picture: Supply Chain Attacks Are Evolving This incident highlights a growing trend: attackers are targeting the tools developers trust. npm packages, GitHub accounts, and even browser extensions can become entry points. And once they're in, they can quietly exfiltrate data for months before anyone notices. For professionals in the antidetect browser space, this is especially relevant. Many of you manage multiple online identities and rely on tools to keep them separate. But if your underlying infrastructure—like your GitHub or npm accounts—is compromised, all that careful separation can be undone. That's why it's crucial to secure not just your browsing, but your entire development pipeline. ### What CrowdSec Could Have Done Differently CrowdSec is a security company, so this breach is particularly embarrassing. But it also shows that even experts can slip up. Here's what they might have done to prevent it: - **Automated offboarding:** When an employee leaves, their access should be revoked automatically across all systems. - **Regular audits:** Periodically review who has access to what, and remove unnecessary permissions. - **Endpoint detection:** Tools that monitor for unusual activity on employee devices could have caught the credential theft earlier. ### Your Action Plan Don't wait for a breach to review your security. Start today: - Check your GitHub and other code repository permissions. Remove anyone who shouldn't have access. - Enable two-factor authentication everywhere. - Use a password manager and never reuse credentials. - Stay informed about supply chain threats and update your dependencies carefully. The CrowdSec incident is a reminder that security is a chain, and it's only as strong as its weakest link. Sometimes that link is a forgotten laptop.