Hacker News Reader

Comment by jchw | Hacker News Reader

> Based on subsequent analysis, we believe this API key was obtained by the attacker when they downloaded a set of private npm repositories using a stolen OAuth token from one of the two affected third-party OAuth applications described above.

Does this imply there was unencrypted AWS credentials stored in an NPM repository and/or possibly GitHub? Seems like a bad idea, though I’m sure it’s hard to get off that practice if you’ve been on it for a long time.

View on HN

specifically the attack Github describes seems to go:

            ???
             ↓
    Heroku/Travis OAuth token
             ↓
      Private GitHub repo
             ↓
    S3 token for NPM prod infra

Is it possible they used Github Actions and the attacker was able to access the secrets?

> Does this imply there was unencrypted AWS credentials stored in an NPM repository and/or possibly GitHub?

Large organisation, hundreds of developers. Kind of likely that something is visible somewhere. Still a bit surprising it’s the prod access keys for npm…

GitHub’s own Application Security product has secret scanning, allowing you an overview of secrets exposed across your entire organization.

Reply on news.ycombinator.com