Context
I work at a mid-sized company, where everything is proprietary.
As with all software companies we use distributed version control, meaning all employees have all the code on their computer at any time.
Recently the team lead for our mobile product hired a poorly performing junior dev. Eventually this team 'lead' has left the company, let's call it mutually.
Theft
Today the junior he hired was overheard saying he figured how to do something after he sent github links to someone - we (his colleagues, not managers) assumed he was applying for other jobs since the lead who was protecting him had left.
Out of interest one of us looked at his public github profile and we discovered he has released two libraries which are helper classes from our project (which I wrote and the company owns). They even aren't his work at all.
Equally worrying is the contributions for his page show a lot of heavy committing in private repos at the same time he stole the helper classes - first when he was first given access to our company code and again since his friend/lead was let go.
What next?
We are all sure he is stealing all of the company code now that he is applying elsewhere. We've all had conflicts with him in the past but have not been able to prove anything as he is very sly.
What should we do? (If anything). How should we bring this up to company management? What proof we we need? Is there a way for us to prove when a local repo is pushed to a new remote, if he did it that way?