CrowdSec Donates 170 Private Repos

Same story different day, this time featuring French security firm CrowdSec discovering an intruder cloned 170 of their private GitHub repositories back in May. The miscreant simply waltzed in courtesy of a TanStack npm attack and the lingering credentials of an employee who had just left. Protecting ourselves from such predictable embarrassment requires actually disabling accounts the moment staff leave rather than leaving the digital keys under the mat. It seems even cybersecurity firms struggle with basic offboarding.