Securing the open source supply chain by scanning for package registry credentials

Why package registry tokens are a prime target

Software projects routinely depend on third-party packages rather than building everything from scratch. Those packages are usually stored and distributed through package registries such as PyPI, npm, or RubyGems. To publish or update a package in one of these registries, developers authenticate with a secret — commonly an API key or token.

Unlike shared code libraries, package registry credentials open the door to the entire open source software ecosystem. A leaked npm or PyPI token no longer merely risks one account. It gives an unauthorized actor the ability to publish malicious versions of widely used packages, and every project that depends on that package — Directly or transitively — becomes susceptible to compromise.

GitHub has been running secret scanning since 2015. In recent years it has expanded from general cloud provider credentials to the authentication material used by those package registries. The company has now formalized partnerships with PyPI and RubyGems while maintaining support for npm, NuGet, and Clojars secrets. In all cases, every push to a public repository or gist is checked for leaked credentials; confirmed leaks are routed to the registry partner, which revokes the token and notifies the account owner.

Leaking one package credential can poison thousands

The protection matters because the supply chain is distributed, not linear. A single open source library is often pulled into hundreds of thousands of other projects, and every library those projects build on inherits the same dependency chain. Compromise one popular package's publishing credentials and a malicious actor can slip malware into the package stream that then flows to downstream projects.

That is not theoretical. In 2018, an ESLint maintainer's npm account was taken over and malicious versions of two ESLint packages were published. The infected packages, when installed, transmitted users' own npm secrets to the attacker. The damage was contained within hours, but it was wide enough that npm revoked every active secret generated prior to resolution.

The scale of what hangs on a compromised credential becomes clear when considering the usage of an ordinary tool. boto3, the AWS SDK for Python, is hosted on PyPI and received over 153 million downloads in a single month in 2021. A published malicious version of such a package would land in the software of potentially hundreds of millions of application instances.

How advanced secret scanning works

GitHub's secret scanning service is automatic for public repositories. Organizations can optionally enable it for private repositories under GitHub Advanced Security. Scanning attempts to recognize the format of supported token types across more than 70 secret patterns from 40 partners, and integrations are added on a cadence.

When a credential is found in a public repository, the finding is sent to the provider — say, RubyGems — which revokes the token and emails the package maintainer. If the secret is detected in a private repository with scanning enabled, the alert is surfaced directly to the repository owner rather than passed to an external party.

Coverage today

The current set of supported package registries spans npm, NuGet, Clojars, PyPI, and RubyGems. These services collectively host 2.3 million packages as of May 2021. GitHub reports that in a single year the service scanned public repositories for credentials from those registries and found thousands of exposed package registry secrets, each of which was then revoked with the registry's cooperation.

Attention goes beyond package registries. In the same period, GitHub added Adobe and OpenAI to the secret scanning partner list, underscoring that token sprawl extends into many types of cloud and SaaS platforms.

With the code hosting and distribution both covered under one detection and revocation loop, a developer who commits a registry token to a public repository can have the credential invalidated within seconds — before it ends up in a crawler index or a credential-harvesting bot's list.