CrowdSec, a French security company, disclosed on September 18 that an attacker copied roughly 170 of its private GitHub repositories on May 22. The breach was carried out using the account of an employee who had just left the company, but whose GitHub access had not been revoked.
The company says the employee's laptop was compromised in May, and it connects the incident to the TanStack npm attack as the initial vector. CrowdSec did not reveal the breach until months later, on September 18.
The incident underscores two recurring problems: the danger of leaving access active after an employee departs, and the wide-reaching impact of supply-chain attacks that target popular open-source packages.