CrowdSec says attackers tied to TeamPCP used a former employee’s lingering GitHub access to clone roughly 170 private repositories, turning an earlier software supply-chain compromise into a wider source-code and credential exposure.
The security company disclosed the incident in an analysis of the May 2026 TanStack npm breach. CrowdSec said the attackers compromised the popular JavaScript project and backdoored 42 packages with credential-stealing malware before moving laterally through access that should have been revoked.
A dormant identity became the breach path
According to CrowdSec, the exposed repositories contained an active Amazon Web Services credential that the attackers tested in August. The stolen material also included 83 user email addresses and identifying or investment information connected to 51 investors. Those figures are CrowdSec’s findings and have not been independently verified.
The incident is a sharp reminder that offboarding failures can outlive the systems employees used every day. A forgotten code-hosting identity can expose proprietary software, deployment secrets and the internal map attackers need for a second intrusion.
Security teams should treat workforce departures as a coordinated identity event across source-control platforms, cloud consoles, CI/CD systems and third-party developer tools.
Repository scans for hardcoded secrets are also essential, but discovery alone is not enough. Keys found in code should be revoked and rotated immediately, while access logs should be reviewed for cloning, unusual token use and changes to build pipelines.
For defenders, the important question is not only what was copied. It is whether attackers altered code, workflows or release infrastructure before access was removed. That requires integrity checks against trusted baselines and close review of recent commits, automation tokens and package-publishing permissions.
