I'm a software developer at a well-known financial company. My team consists of three junior software developers, and our team lead has taken more of the manager, hence there is really no supervision on the quality of the code.
About six months ago, we were asked to work on a relatively large project and decided to get the help of another team. We instantly regretted collaborating with the other team due to their attitude, work ethic and lack of communication. I think they probably feel the same about us, but that's a different story. We divided responsibilities (different applications/different code sources that work together as one, basically micro-services) and until about a few weeks ago one of the best developers of the other team (I am not going to hide it but she is very smart) was talking to us about a number of her GitHub repos and their stars. I saw she has a lot of repos, to the point that she is like full-time open source project contributor.
Fast forward to last week, I saw she has contributed to the application and that wasn't her responsibility, but I saw she deleted a lot of code, and added a reference an external package to replace them. I got curious and I saw all the code that was deleted is in her personal GitHub.
We confronted her recently and she got very aggressive but she argued that we use random people's open source library and it's not different.
I am concerned that not only this behavior will not professional but we dangerous as it paves the day for hackers to find security holes because a lot of security utilities codes are also shared in her public GitHub. By quickly glancing her GitHub, I see a lot of code that is obvious that it has been taken from the company.
I will have a 1-1 meeting with my manager in a few days, and I am wondering what should I exactly say. Is this behavior professional? is it even legal? I don't want to be responsible for someone else's actions.
Update: I sent an email to the manager and requested a few minutes of 1-on-1 meeting to explain the situation. She got fired immediately after the meeting. The manager said it is too late to take back the code and the company will not attempt to take back the code.