npm breach fallout: stolen OAuth tokens and a separate credential logging issue

GitHub has completed its investigation into the April attack on npm infrastructure that began with stolen OAuth user tokens. The company is also disclosing a separate, unrelated finding: plaintext user credentials were captured in internal npm logs following the integration of npm into GitHub logging systems. That issue was mitigated and the logs purged before the OAuth token attack took place.

According to GitHub, the attacker used OAuth tokens stolen from two third-party integrators—Heroku and Travis CI—to access private npm repositories, some of which contained secrets including AWS access keys. Those keys were then used to enter npm's AWS infrastructure and exfiltrate data.

What the attacker accessed

The exfiltrated data included a backup of the skimdb.npmjs.com mirror from April 7, 2021. That backup contains metadata and package manifests for all public and private packages in the registry, including READMEs, version histories, maintainer email addresses, and package install scripts—but not the package tarballs themselves. It also holds an archive of npm user information from 2015.

That user archive includes npm usernames, email addresses, and password hashes for roughly 100,000 users. The hashes were generated using PBKDF2 or salted SHA1 algorithms that npm has not used since 2017, when the registry moved to bcrypt. GitHub has reset passwords for affected users and is notifying them directly.

In addition, the attacker obtained:

  • A series of CSV files with directory listings of the S3 buckets storing npm packages, exposing the names and published semVer versions of all private packages as of April 10, 2022.
  • Private package contents from two specific organizations, which GitHub has notified directly.

GitHub states that, based on log and event analysis as well as package hash verification on all versions of all packages, it is currently confident the attacker did not modify any published packages or publish new versions to existing packages.

A separate credential logging flaw

During an internal review unrelated to the OAuth token attack, GitHub discovered that a subset of npm service logs contained credentials that had not been properly sanitized. These logs included npm access tokens and a small number of plaintext passwords used in sign-in attempts to npm accounts, as well as a small set of GitHub Personal Access Tokens that users had sent to npm.

GitHub says the issue was mitigated and all affected logs were purged before the attack on npm. The company's investigation concluded that only internal GitHub employees had access to the data at the time of exposure, and that no compromise or breach exposed the logs containing plaintext credentials. GitHub is notifying affected users of plaintext passwords and GitHub Personal Access Tokens based on available logs.

Mitigations and user actions

GitHub notes that as of March 1, 2022, the npm registry has email verification enabled on all accounts that do not have 2FA enabled, which means compromising an npm account would require access to the associated email address or second factor.

Users who want to rotate npm tokens can do so by following the instructions at https://docs.npmjs.com/revoking-access-tokens. Password resets are available at https://www.npmjs.com/forgot, and questions can be directed through https://www.npmjs.com/support.