Rewterz Threat Update– Threat Actors Stole Nearly 100,000 NPM Users’ Credentials In GitHub OAuth Breach

Severity

High

Analysis Summary

GitHub announced that attackers used stolen OAuth app tokens supplied to Heroku and Travis-CI to steal the login data of around 100,000 npm accounts during a mid-April security compromise. The threat actor successfully penetrated and exfiltrated data from private repositories belonging to dozens of organizations.

They notified this security compromise on April 15, three days after the bad actor obtained access to the npm production infrastructure. The threat actor used a compromised AWS access key to get access after downloading numerous private npm repositories with stolen OAuth user tokens in the early stage of the attack. Following the discovery of the incident, GitHub, Travis CI, and Heroku removed all OAuth tokens to prevent additional hacking efforts.

According to an update supplied by the firm, the attackers were able to elevate access to npm infrastructure and retrieve the following files exfiltrated from npm cloud storage:

• A backup of skimdb.npmjs.com dated April 7, 2021, including the following information: An archive of user data from 2015. This included the usernames, password hashes, and email addresses of around 100k npm users.
• As of April 7, 2021, all private npm package manifests and package metadata.
• A collection of CSV files containing an archive of all names and version numbers (semVer) of all npm private package published versions as of April 10, 2022.
• Private packages from two organizations.

The attackers did not edit any packages in the repository or publish any new versions of existing packages, according to the log analysis and package hash verification. An investigation into the OAuth token attack revealed a number of plaintext user credentials for the npm registry that were collected in internal logs. Also, the organization is resetting the passwords of impacted users and notifying users by email.

The company concludes:

• Passwords belonging to users of the accessed database backup have been reset. 
• The two organizations that had private packages stolen were alerted after analysis confirmed the activity.
• Over the next few days, anyone with exposed private package manifests, metadata, private package names, and versions will be notified directly.

Impact

Credential Theft
Sensitive Information Theft

Remediation

• Those who want to rotate your npm tokens can follow the four detailed steps here. Or follow these steps

1. To see a list of your tokens, run ‘npm token list’ on the command line

2. In the tokens table, find and copy the ID of the token you want to delete.

3. On the command line, run the following command, replacing 123456 with the ID of the token you want to delete:  npm token delete 123456

npm will report Removed 1 token

4. To confirm that the token has been removed, run: npm token list

• If you would like to reset your password manually, click here.