GitHub says an attacker used stolen OAuth user tokens issued to Heroku and Travis-CI to download data from private repositories belonging to npm and other orgs
GitHub revealed today that an attacker is using stolen user tokens (issued to Heroku and Travis-CIOAuth) to download data from private repositories. Source: The GitHub Blog and Heroku Status .
BleepingComputerSergiu Gatlan
Context & Ripple Effects
The incident extends a known OAuth-token exposure pattern: stolen GitHub and GitLab OAuth tokens at Waydev were previously described as a potential pivot point into other companies. Here, the reported destination is private source-code repositories, including npm.
Private repository data belonging to npm and other organizations was downloaded through user tokens issued to Heroku and Travis-CI, putting the affected organizations' nonpublic code and data in an attacker's hands.
Heroku and Travis-CI are immediately implicated as the OAuth token issuers whose credentials provided the reported route into GitHub repositories.
Second-order effects
Organizations that connected GitHub accounts through Heroku or Travis-CI must treat third-party OAuth credentials as a path to private code, rather than as a risk isolated to the connected service.
GitHub, Heroku, and Travis-CI face pressure to limit the blast radius of compromised user-authorized tokens, because a breach at one integration can expose repositories at many organizations.
Third-order effects
The episode points toward software-development access being governed by the security of the full OAuth integration chain, not solely by GitHub account protections.
As private repositories become an entry point into npm-related supply-chain incidents, token-scope and third-party authorization controls become a structural security boundary for code-hosting ecosystems.
The trend: Developer-platform security is shifting from protecting individual code hosts to controlling the third-party OAuth relationships that can grant access across the software supply chain.
Not to ruin anyone's holiday weekend, but if your org uses @heroku or @travisci, there's an active investigation going on into compromised OAuth tokens used for integration with @GitHub (who initially identified the issue). Action this now. 1/2 https://status.heroku.com/... https…
GitHub has uncovered evidence that an attacker abused stolen OAuth user tokens issued to two third-party OAuth integrators, Heroku and Travis-CI. Read more about the impact to GitHub, npm, and our users. https://github.blog/...
On April 12, GitHub Security began an investigation that uncovered evidence that an attacker abused stolen OAuth user tokens issued to two third-party OAuth integrators, Heroku and Travis-CI, to download data from dozens of organizations, including npm https://github.blog/...
If you run apps on Heroku you should be keeping an eye on this incident: https://status.heroku.com/... The GitHub breach disclosed earlier involved oauth tokens belonging to the Heroku Dashboard, so there's a very high likelihood that some part of Heroku got popped too.
“To mitigate impact from potentially compromised Auth tokens, we will revoke over the next several hours all existing tokens from the Heroku GitHub integration.” Whoa. https://status.heroku.com/
attacker abused stolen (but not stolen from GitHub) OAuth user tokens issued to two third-party OAuth integrators, Heroku and Travis-CI, to download data from private repos of dozens of organizations, including npm https://twitter.com/...
The worst security incident in 14 years of using Heroku and GitHub strikes on one of the UK's best bank holiday weekends. Who else will be spending a chunk of this lovely day reviewing security logs and rotating access tokens? :( https://status.heroku.com/... https://github.blog/…