Former Employee’s GitHub Access Misused After TanStack npm Supply‑Chain Attack, Exposing 170 Private CrowdSec Repos
What Happened — An attacker leveraged the still‑active GitHub account of a CrowdSec employee who had left the company. The account was used on May 22 to clone roughly 170 private repositories after the employee’s laptop was compromised in the May 2024 supply‑chain attack on TanStack’s npm packages.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of lingering privileged accounts – a core control‑area for continuous identity‑and‑access‑management monitoring.
- Highlights the need for supply‑chain vetting and rapid revocation processes to maintain a defensible audit trail.
- Aligns with the control objective of “timely de‑provisioning of user access” that satisfies multiple frameworks (e.g., NIST CSF 2.0, ISO 27001).
Who Is Affected – SaaS security vendors, development teams using open‑source npm packages, and any organization that grants external developers repository access.
Recommended Actions
- Immediately audit all privileged accounts for former employees and enforce automated de‑provisioning.
- Integrate supply‑chain monitoring to detect compromised third‑party tooling.
- Capture evidence of access‑revocation workflows for audit readiness. Source: The Hacker News
Technical Notes – The attacker’s foothold originated from a malicious TanStack npm package that harvested credentials from the compromised laptop, then used those credentials to authenticate to GitHub via the employee’s personal access token. No public CVE is associated; the vector is a supply‑chain credential theft. Source: same as above