GitHub revealed today that an attacker is using stolen OAuth user tokens (issued to Heroku and Travis-CI) to download data from private repositories.
Since this campaign was first spotted on April 12, 2022, the threat actor has already accessed and stolen data from dozens of victim organizations using Heroku and Travis-CI-maintained OAuth apps, including npm.
“The applications maintained by these integrators were used by GitHub users, including GitHub itself,” revealed today Mike Hanley, Chief Security Officer (CSO) at GitHub.
“We do not believe the attacker obtained these tokens via a compromise of GitHub or its systems, because the tokens in question are not stored by GitHub in their original, usable formats.
“Our analysis of other behavior by the threat actor suggests that the actors may be mining the downloaded private repository contents, to which the stolen OAuth token had access, for secrets that could be used to pivot into other infrastructure.”
According to Hanley the list of impacted OAuth applications includes:
- Heroku Dashboard (ID: 145909)
- Heroku Dashboard (ID: 628778)
- Heroku Dashboard – Preview (ID: 313468)
- Heroku Dashboard – Classic (ID: 363831)
- Travis CI (ID: 9216)
GitHub Security identified the unauthorized access to GitHub’s npm production infrastructure on April 12 after the attacker used a compromised AWS API key.
The attacker likely obtained the API key after downloading multiple private npm repositories using stolen OAuth tokens.
“Upon discovering the broader theft of third-party OAuth tokens not stored by GitHub or npm on the evening of April 13, we immediately took action to protect GitHub and npm by revoking tokens associated with GitHub and npm’s internal use of these compromised applications,” Hanley added.
The impact on the npm organization includes unauthorized access to private GitHub.com repositories and “potential access” to npm packages on AWS S3 storage.
GitHub’s private repositories not affected
While the attacker was able to steal data from the compromised repositories, GitHub believes that none of the packages were modified and no user account data or credentials were accessed in the incident.
“npm uses completely separate infrastructure from GitHub.com; GitHub was not affected in this original attack,” Hanley said.
“Though investigation continues, we have found no evidence that other GitHub-owned private repos were cloned by the attacker using stolen third-party OAuth tokens.”
GitHub is working on notifying all impacted users and organizations as they are identified with additional information.
You should review your organization’s audit logs and the user account security logs for anomalous, potential malicious activity.
You can find more information on how GitHub responded to protect its users and what customers and organizations need to know in the security alert published on Friday.
