A developer left the company. His OAuth token didn't. Nine minutes into that session, the intruder held ~170 private repos — and the audit logs held nothing.
On September 18 the French security company CrowdSec published an unusually candid postmortem. On May 22, inside a nine-minute window (05:52–06:01 UTC), an intruder cloned ~170 private GitHub repositories using the OAuth token of a developer who had already left — his access was only revoked on May 25, three days later. The employee's laptop had been compromised in May's Mini Shai-Hulud campaign against TanStack npm packages, whose malicious versions harvested credentials from developer machines. Cloning via OAuth left no trace in audit logs: the company learned about the copying four months later, on September 16, when the archive surfaced on a leak forum. Alongside the code it held the e-mail addresses of 83 users (<0.05% of ~150K) and details of 51 prospective investors from a 2020 round. Infrastructure and databases were untouched, no code was altered, and the one AWS SNS token found in the code was properly scoped.
Two gaps lined up into one: a token that outlived the employee, and a copying method invisible to standard auditing. Each alone is routine debt; together they meant four months of your code in someone else's hands without a single signal.
What this means for a lead. Offboarding is not an HR ticket but a security procedure with a same-day SLA. Three things worth checking today, before anyone hands in notice. Revoke OAuth tokens and SSH keys in the same procedure that disables the account, not in a separate ticket for "later": at CrowdSec those steps sat three days apart, and nine minutes was all it took. Put TTLs on tokens: a key with no expiry is a door that will one day stand unwarded. Alert on bulk cloning: if your monitoring can't tell "a developer updated a repo" from "someone hauled out 170 in nine minutes," you don't have monitoring — you have an archive.
Now the contentious part. Today's "insider" is less and less a person with ill intent, and more and more a script acting on behalf of their compromised session. So part with people humanely — and that same hour, treat their sessions as compromised. There is no suspicion of the departed in this, only respect for what they left in your keeping.
📎 crowdsec.net/blog/tanstack-supply-chain-attack-analysis · thehackernews.com/2026/09/crowdsec-says-tanstack-npm-attack-led.html