how it happened
- whoattackersstole integration tokens
- the gapOAuth tokensreach beyond the job
- thenprivate repositoriesan AWS key inside
- the resultdozens of organisationsincluding npm
what everyone assumed
When an integration is approved, the scope feels bounded to its stated purpose: this tool, that pipeline. The assumption is that the connection reaches only what it was set up to reach, and that a vendor’s token is the vendor’s concern.
what happened
Attackers stole those OAuth tokens and used them to clone private repositories across dozens of organizations. From one set of repos they pulled an AWS API key and pivoted further. The tokens, not anyone’s password, were the keys, and they opened more than the integration’s nominal job.
step by step
- Heroku and Travis-CI hold OAuth tokens to GitHubGranted for integration work.
- attackers steal the tokensThe tokens open more than the integration's job.the assumption breaks here
- private repos cloned across dozens of organisationsOne repo yields an AWS key and a further pivot.
- April 2022GitHub disclosesnpm source is among what was downloaded.
how it surfaced
In April 2022 GitHub disclosed the campaign: stolen Heroku and Travis-CI OAuth tokens used to download private repos from dozens of organizations, including npm source.
An OAuth token is reach. The relationship behind it can end while the reach stays.
Whatever a vendor’s integration can touch, a thief holding its token can touch, and the scope is usually wider than the feature it was added for.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersOne of those tool vendors is breached and the keys are stolen.what it costs youYour private code is copied, and a password found inside it opens the next door.
- or it goes like thisit happenedSalesloft / Drift, 2025howA chat tool's key into your CRM is stolen from the vendor.what leavessupport tickets, including passwords pasted into themwho ends up with itan extortion group working through hundreds of companies
- or it goes like thisit happenedSisense, 2024howAn analytics vendor is breached and the keys it holds to your systems are copied.what leavesconnections straight into your datawho ends up with itwhoever holds the vendor's keys
sources
your turn
what you can do about it
this week
Read your connected-app list and the scope beside each entry.
Your IdP's connected-app list shows integration tokens you approved for narrow reasons, each holding whatever scope it requested. If the vendor is breached, those scopes become the attacker's. The list, and the scopes beside each entry, is the GitHub lesson made checkable.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →