When a former employee walks out the door, most companies remember to collect the laptop and the badge. Far fewer remember to revoke their GitHub access. That small oversight turned into a very large headache for CrowdSec, the French cybersecurity firm that disclosed on September 18 that an attacker copied roughly 170 of its private GitHub repositories back in May.

How a Departed Employee Became the Weakest Link

According to CrowdSec, the intruder gained entry through the GitHub account of an employee who had already left the company. The company had neglected to close that account, leaving a credentialed door propped open long after the person behind it had moved on. In security circles, this is sometimes called orphaned access, and it remains one of the most stubborn and avoidable risks in modern software organizations.

The story gets more tangled from there. CrowdSec says the former employee’s laptop was compromised during May’s supply chain attack on TanStack, in which malicious versions of TanStack’s npm packages were published to steal credentials from developers who installed them. That stolen session or token then gave the attacker a path straight into CrowdSec’s private code.

Why the TanStack npm Incident Matters Beyond One Company

Supply chain attacks on package registries are not new, but their reach keeps expanding. When a popular npm package is poisoned, the blast radius is measured not in downloads but in the number of trusted developer machines that quietly hand over secrets. TanStack’s packages are widely used in the JavaScript ecosystem, which made the May campaign a particularly efficient credential harvester.

From a domain and infrastructure perspective, this is a reminder that identity is now the front door to everything. A single valid token can bypass firewalls, multi factor prompts, and perimeter defenses that organizations spent years building. The attacker did not need to break in; they simply logged in.

The 170 Repository Question

Copying 170 private repositories is not a smash and grab. It suggests either automation or patience, or both. Private repositories often contain proprietary algorithms, internal API keys, deployment scripts, customer data schemas, and sometimes hardcoded secrets that never should have been committed in the first place.

CrowdSec has not said publicly which repositories were taken or what they contained, and that silence is standard during incident response. Still, the disclosure timing, roughly four months after the May attack, hints at a lengthy forensic investigation. Companies rarely announce these things until they understand scope, and scope in supply chain cases is notoriously slippery.

What This Means for Developers, Founders, and Domain Owners

If you run any kind of online business, whether it is a SaaS product, a hosting company, or a portfolio of domains, your code and your credentials are brand assets. A breach does not just expose source files; it can expose customer trust, which is far harder to rebuild. This is why clean offboarding procedures, token rotation, and least privilege access are not bureaucratic extras. They are the seatbelts of digital operations.

For domain investors specifically, the lesson cuts close to home. Many of us manage dozens or hundreds of registrar accounts, DNS panels, and hosting dashboards, often with shared credentials or legacy API keys we forgot we created. If a single compromised laptop can hand over 170 repositories, imagine what it could do to a portfolio of premium domains and the revenue tied to them.

That is one reason it pays to consolidate where it makes sense. Register it (registerit.click) offers free domain registration alongside web hosting, giving founders and investors a straightforward place to manage their digital presence without scattering credentials across a dozen forgotten logins. Fewer accounts, fewer orphaned tokens, and a cleaner security posture overall.

Offboarding Is a Security Control, Not an HR Formality

Most breaches tied to former employees are not malicious insider jobs. They are administrative failures that linger for months. A checklist that includes revoking GitHub, GitLab, cloud provider, npm, and registrar access on the last day of employment would have likely prevented this entire episode.

It also helps to treat every credential as if it will eventually leak. Short lived tokens, mandatory rotation, and hardware backed authentication reduce the window an attacker can operate. None of these measures are glamorous, and none of them make for a good conference keynote. They just work.

The Bigger Picture for Digital Ownership

As the web becomes more dependent on shared code and third party packages, the boundary between your infrastructure and everyone else’s keeps blurring. A breach at a package registry can cascade into a breach at a security company, which can cascade into exposed repositories, and so on down the chain. Understanding that chain is becoming a core competency for anyone who builds or invests online.

The companies that thrive will be the ones that treat identity, access, and digital assets with the same seriousness they treat revenue. Your domain name, your hosting account, and your source code are not separate concerns. They are all part of the same trust surface, and attackers only need one weak point to walk through it.

Looking ahead, expect domain and hosting providers to compete less on price alone and more on security features like passkeys, granular access controls, and automatic credential expiration. The future of online presence will belong to platforms that make good security habits the default rather than the exception. After all, the best time to close a door is before someone walks through it.