GitHub has published the results of an investigation into an attack that occurred on April 12, during which attackers gained access to cloud environments in the Amazon AWS service used in the NPM project infrastructure. The incident analysis revealed that the attackers accessed backups from the host skimdb.npmjs.com, including a backup of the database containing account information for approximately 100,000 NPM users from 2015, including password hashes, names, and email addresses.
Password hashes were created using PBKDF2 or SHA1 algorithms with salt, which were replaced in 2017 with the more secure bcrypt. Following the incident, the compromised passwords were reset, and users were notified to set a new password. Since March 1, mandatory two-factor authentication with email confirmation has been implemented in NPM, and the risk of user compromise is assessed as low.
Additionally, the attackers obtained all manifest files and metadata of private packages as of April 2021, CSV files with the current list of all names and versions of private packages, and the contents of all private packages belonging to two GitHub clients (names are not disclosed). Regarding the repository itself, analysis of traces and verification of package hashes did not find any changes made by the attackers to NPM packages or the publication of fake new versions of packages.
The attack was carried out on April 12 using stolen OAuth tokens generated for two third-party GitHub integrators — Heroku and Travis-CI. By utilizing these tokens, the attackers were able to extract a key for accessing the Amazon Web Services API from private GitHub repositories, which is used in the NPM project infrastructure. The obtained key allowed them to access data stored in the AWS S3 service.
Additionally, information about previously identified serious privacy issues regarding user data processing has been disclosed. servers NPM — passwords of several NPM users and access tokens were stored in plaintext in internal logs. During the integration of NPM with GitHub's logging system, developers failed to sanitize sensitive information from the log requests to NPM services. It is claimed that this oversight has been rectified, and the logs have been cleared before the attack on NPM. Access to the logs containing plaintext passwords was restricted to a few GitHub staff members.
Source: opennet.ru
