> Using their initial foothold of OAuth user tokens for GitHub.com, the actor was able to exfiltrate a set of private npm repositories, some of which included secrets such as AWS access keys.

So NPM was storing AWS secrets in their (private) git repos. IMHO that was an accident waiting to happen.