GitHub hacked, npm data stolen after 0auth tokens stolen in upstream breach

[FloatingFatMan]

Kinda surprised this isn't all over tech news sites...

 

Quote

 

GitHub hacked after Heroku, Travis-CI 0auth tokens stolen in upstream attack

 

An unknown attacker breached GitHub to download data from scores of private code repositories including that of npm — the world’s largest software registry with 75 billion downloads a month — the company has confirmed in a hugely troubling cybersecurity incident. GitHub says it and other affected companies were compromised after the attacker stole authentication tokens from two other upstream software firms.

 

GitHub Security confirmed the breach on April 18, saying it spotted unauthorised access to its own npm production infrastructure using a compromised AWS API key on April 12 as part of the evolving incident. (GitHub operates numerous microservices and databases underpinning production infrastructure for the npm registry; a JavaScript code hub and the largest software registry in the world, which it bought in 2020.)

 

GitHub said it saw “unauthorized access to, and downloading of, the private repositories in the npm organization on GitHub.com and potential access to the npm packages as they exist in AWS S3 storage… we assess that the attacker did not modify any packages or gain access to any user account data or credentials.”

  

https://thestack.technology/github-hacked-npm-data-downloaded-in-an-evolving-supply-chain-attack/amp/

 

[adrynalyne]

Oof.

[FloatingFatMan]

On 19/04/2022 at 20:03, adrynalyne said:

Oof.

Indeed.  Thousands of companies use GitHub as code repositories... Including mine!

[adrynalyne]

On 19/04/2022 at 12:06, FloatingFatMan said:

Indeed.  Thousands of companies use GitHub as code repositories... Including mine!

We use Azure DevOps, but like many, an eff ton of node packages. I didn't see it in the article, but wish we knew who the compromised customers were to check. Unless it was just Travis-CI  and Heroku? 

[FloatingFatMan]

On 19/04/2022 at 20:12, adrynalyne said:

We use Azure DevOps, but like many, an eff ton of node packages. I didn't see it in the article, but wish we knew who the compromised customers were to check. Unless it was just Travis-CI  and Heroku? 

AFAIK, they're notifying affected clients individually.  We got a security alert about it this morning from our IT department so pretty much every single team was in panic stations mode...

 

Funny thing is, we used to use TFS on our own servers but moved everything to GitHub last year to save costs!  DOH!  

[adrynalyne]

On 19/04/2022 at 12:22, FloatingFatMan said:

AFAIK, they're notifying affected clients individually.  We got a security alert about it this morning from our IT department so pretty much every single team was in panic stations mode...

 

Funny thing is, we used to use TFS on our own servers but moved everything to GitHub last year to save costs!  DOH!  

Oof. I seem to be saying that a lot. I was a proponent of GH but was overruled. Blessing in disguise I guess. 😁

[GSDragoon]

This sounds like keys from companies that use GitHub got compromised and not so much "GitHub got hacked".

[+illumination Subscriber²]

On 19/04/2022 at 22:10, GSDragoon said:

This sounds like keys from companies that use GitHub got compromised and not so much "GitHub got hacked".

I agree. My understanding of the article is that some Heroku tokens were compromised and those allowed access to some client tokens which in turn allowed access to private Github repositories. It's not clear to me on the impact to npm, but I guess they were one of the Heroku clients that were compromised.