On 12 April 2022 GitHub began an investigation that found an attacker abusing stolen OAuth user tokens issued to two third-party integrators, Heroku and Travis-CI, to download private repository contents from dozens of organisations. Among them was npm, whose private repositories were accessed and downloaded, with potential access reported to npm packages held in AWS S3 storage. A subset of Heroku’s own private repositories was downloaded on 9 April.
GitHub reported analysis suggesting the actor was mining downloaded repository contents for secrets that could be used to reach further infrastructure. Tokens were revoked and affected customers notified through late April.
Nothing Was Broken At GitHub
The tokens were issued by GitHub, held by third parties so their services could act on users’ behalf, and honoured by GitHub because that is what a valid token is for. The compromise happened at the integrators.
We have recorded this shape repeatedly — 22-0120, where an identity provider was reached through its outsourced support desk, and 23-0420, where a supply chain compromise was used to run another. Delegated authority means the security of a system is the security of everyone it has delegated to, and that set is rarely enumerated by the people relying on it.
The Target Was What Was Inside The Repositories
The reported behaviour — mining downloaded code for secrets to pivot with — says the repositories were an intermediate objective, not the prize.
This corpus keeps finding credentials sitting in source control: at 22-1101, where plaintext API keys were in the Dropbox repositories; at 22-1222, where a privileged access manager’s own credential sat in a script; at 23-0104, where CircleCI told customers to rotate every secret it held. A private repository is treated as a safe place to leave a key, and it is a place a token can reach.
Revocation Is Fast And Late
Revoking every affected token is the correct response and it is available immediately, which is more than most incidents in this corpus can offer.
It also does nothing about what was already cloned. We filed that distinction at 22-0721, where a flaw fixed in twelve days had already leaked, and at 26-0714b. Everything copied before revocation stayed copied, including any secrets inside it, and those had to be found and rotated by each organisation separately.
Compiled from GitHub’s own security advisory and contemporaneous reporting, listed below. No actor is named — none was publicly identified. No count of affected organisations beyond "dozens" is asserted, because none was published. Graded high. Corrections: corrections@forensicpost.com.