I did a bit more research, and found that it wasn't an official SolarWinds GitHub repo. It seems to have been an employee's personal repo containing company cod

I did a bit more research, and found that it wasn't an official SolarWinds GitHub repo. It seems to have been an employee's personal repo containing company code that they accidentally made public.[1] The original URL of the file with credentials in it was https://github.com/xkozus00/mib-importer/blob/master/Src/Lib/PurgeApp/PurgeApp.exe.config https://github.com/xkozus00/mib-importer/blob/master/Src/Lib... .[2] That is, the credentials were part of a utility/library that was only being referenced by the project, but it was still included in the repo. SolarWinds historically hasn't provided a tool to import arbitrary MIB files into their product. Customers seem to submit them to SolarWinds support, and if support agrees, they seem to use internal tooling (presumably the mib-importer) to import them into the official MIB database.[3] Building some sort of official release data could easily require the use of a signing key, and a company that uses "solarwinds123" as their code-publishing password seems likely to use the same key for multiple purposes, but I didn't find any conclusive evidence, and it's certainly possible the two incidents aren't related. [1] https://savebreach.com/solarwinds-exposed-ftp-credentials-back-in-2018-says-security-researcher-vinoth/ https://savebreach.com/solarwinds-exposed-ftp-credentials-ba... [2] The Wayback machine has a few entries archived, but none of the interesting/conclusive information, see: https://web.archive.org/web/*/https://github.com/xkozus00/mib-importer/ https://web.archive.org/web/*/https://github.com/xkozus00/mi...* [3] https://documentation.solarwinds.com/en/success_center/NPM/content/Core-Downloading-the-SolarWinds-MIB-Database-sw3581.htm https://documentation.solarwinds.com/en/success_center/NPM/c...