GitHub says an attacker used stolen OAuth user tokens issued to Heroku and Travis-CI to steal private repository data from dozens of organizations including npm
GitHub revealed today that an attacker is using stolen user tokens (issued to Heroku and Travis-CIOAuth) to download data from private repositories.Source:The GitHub BlogandHeroku Status.
BleepingComputerSergiu Gatlan
Context & Ripple Effects
This disclosure broadens an already reported campaign affecting npm and other organizations into a problem spanning dozens of victims. It also fits an earlier developer-tool incident in which Waydev said stolen GitHub and GitLab OAuth tokens were likely used to pivot into other companies after its OAuth-token breach.
The significance is that access to private code traveled through permissions granted to connected development services, rather than requiring a direct compromise of each affected GitHub organization.
First-order effects
Organizations whose private repositories were downloaded, including npm, must treat the data reachable through the stolen grants as exposed.
Heroku- and Travis-CI-issued user tokens become the immediate access path under scrutiny, shifting containment attention to connected OAuth grants as well as GitHub repository permissions.
Second-order effects
Organizations using Heroku or Travis-CI OAuth connections face pressure to reassess the repository scope delegated by their users, since a compromised integrated-service token can reach private GitHub code.
The incident reinforces the cross-company pivot risk identified in Waydev's stolen-token disclosure, raising the security burden on developer services that hold reusable OAuth access.
Third-order effects
If this pattern persists, repository security will increasingly be governed by the least-restricted connected developer service, not solely by controls inside the code host.
OAuth integrations in the software supply chain may shift toward narrower, more actively managed grants as organizations seek to limit the blast radius of third-party token theft.
The trend: Developer-tool ecosystems are becoming a shared access-control perimeter, with OAuth token scope determining how far a breach can travel across software organizations.
GitHub has uncovered evidence that an attacker abused stolen OAuth user tokens issued to two third-party OAuth integrators, Heroku and Travis-CI. Read more about the impact to GitHub, npm, and our users. https://github.blog/...
Not to ruin anyone's holiday weekend, but if your org uses @heroku or @travisci, there's an active investigation going on into compromised OAuth tokens used for integration with @GitHub (who initially identified the issue). Action this now. 1/2 https://status.heroku.com/... https…
On April 12, GitHub Security began an investigation that uncovered evidence that an attacker abused stolen OAuth user tokens issued to two third-party OAuth integrators, Heroku and Travis-CI, to download data from dozens of organizations, including npm https://github.blog/...
The worst security incident in 14 years of using Heroku and GitHub strikes on one of the UK's best bank holiday weekends. Who else will be spending a chunk of this lovely day reviewing security logs and rotating access tokens? :( https://status.heroku.com/... https://github.blog/…
“To mitigate impact from potentially compromised Auth tokens, we will revoke over the next several hours all existing tokens from the Heroku GitHub integration.” Whoa. https://status.heroku.com/
If you run apps on Heroku you should be keeping an eye on this incident: https://status.heroku.com/... The GitHub breach disclosed earlier involved oauth tokens belonging to the Heroku Dashboard, so there's a very high likelihood that some part of Heroku got popped too.
attacker abused stolen (but not stolen from GitHub) OAuth user tokens issued to two third-party OAuth integrators, Heroku and Travis-CI, to download data from private repos of dozens of organizations, including npm https://twitter.com/...