3 ms·
> Based on subsequent analysis, we believe this API key was obtained by the attacker when they downloaded a set of private npm repositories using a stolen OAuth
by jchw 5y ago
> Based on subsequent analysis, we believe this API key was obtained by the attacker when they downloaded a set of private npm repositories using a stolen OAuth token from one of the two affected third-party OAuth applications described above.
Does this imply there was unencrypted AWS credentials stored in an NPM repository and/or possibly GitHub? Seems like a bad idea, though I’m sure it’s hard to get off that practice if you’ve been on it for a long time.
- nightpool 5y agospecifically the attack Github describes seems to go: ??? ↓ Heroku/Travis OAuth token ↓ Private GitHub repo ↓ S3 token for NPM prod infra
- DoctorOW 5y agoIs it possible they used Github Actions and the attacker was able to access the secrets?
- Aeolun 5y ago> Does this imply there was unencrypted AWS credentials stored in an NPM repository and/or possibly GitHub? Large organisation, hundreds of developers. Kind of likely that something is visible somewhere. Still a bit surprising it’s the prod access keys for npm…
- jacobr 5y agoGitHub’s own Application Security product has secret scanning, allowing you an overview of secrets exposed across your entire organization.