2026-08-16 · view entry permalink →
Three developer-credential findings this week each show an estate auditing the wrong thing — the wrong package, the wrong incident class, and repositories nobody counted as company assets at all
Supply-chain research usually asks how the attacker got in. Three findings this week ask a different question, and give the same unwelcome answer: the organisations that responded to these incidents looked in the wrong place, and their audits came back clean for that reason.
The clearest case is a correction to a story most estates have already closed. SOCRadar re-analysed the exposure dataset behind the widely reported compromise of around 2,500 organisations through LiteLLM and found that 2,085 of the 2,188 identified organisations — 95% — show collection activity beginning before the poisoned LiteLLM packages reached PyPI on 24 March. The collection instead tracks the compromise of Aqua Security's Trivy scanner, whose poisoned release LiteLLM's own continuous-integration pipeline pulled unpinned (SOCRadar, 2026-08-13), a re-attribution SecurityWeek reported independently (SecurityWeek, 2026-08-14). The operational consequence is specific and awkward: an estate that asked "did we install the affected LiteLLM versions on 24 March" asked about the wrong package on the wrong date, got a negative answer, and closed a genuine exposure. The artefact that actually needed auditing is a security scanner — a tool most CI pipelines pull by mutable tag precisely because it is a security tool and expected to be current.
Wiz's Customer Incident Response Team published the second, a technical playbook for a campaign run against multiple customer organisations that abused compromised GitHub Personal Access Tokens for mass repository exfiltration. The attack shape is worth knowing because it is loud in exactly one place: reconnaissance through GitHub API queries to enumerate everything the token could reach, a small number of validation clones, then bulk theft — "Between 09:14 and 14:55 UTC, the actor used 102 AWS IP addresses located in the ca-central-1 region to clone up to thousands of repositories per organization" (Wiz, 2026-08-13). Wiz's framing is the part that changes response practice: "Repository exfiltration should be treated as more than source code theft. Repositories frequently contain cloud credentials, SaaS tokens, internal documentation, private keys, and sensitive data that can significantly increase the impact of a compromise." An organisation that scopes this as intellectual-property loss writes a legal assessment; an organisation that scopes it as a secrets incident rotates cloud credentials and hunts for their use, which is the difference between the incident ending and continuing. A companion Wiz post reports that across the Forbes AI 50 the firm found "56% of company-impacting secrets lived in employees' personal repositories, where most security programs have no visibility" (Wiz, 2026-08-13) — a third scoping error, this time in what counts as a company asset at all.
The week's third finding supplies the substrate the other two run on. CERT Intrinsec's forensic-artefact series for autonomous coding-agent command-line tools documents that these tools write their state to predictable per-user paths — OpenCode keeping a database of sessions, messages and workspaces alongside a file holding authentication information including API keys, and OpenAI Codex keeping authentication material in auth.json with the operator's prompt history in history.jsonl (CERT Intrinsec, 2026-07-31). Read as an investigator's map that is useful; read as an attacker's inventory it says that any foothold on a developer or build host now reaches cleartext provider credentials at a known location, without touching a keychain or a secrets manager.
Triage: the GitHub-side observable is a shape rather than an indicator, and it is one legitimate tooling does not produce. Enterprise audit-log events showing a single token or principal issuing a burst of repository-clone or archive-download calls, spanning many repositories including ones that principal has never touched, from source addresses distributed across a narrow cloud-provider range within a short window, is anomalous by construction: continuous-integration systems clone repeatedly but from a small, stable set of known egress addresses and against the repositories they build, and a developer clones interactively at human rates. The preceding phase is quieter and worth pairing with it — a rise in API enumeration calls from a token that normally only clones. On developer and build hosts, the corresponding host-side signal is any process other than the agent itself reading those documented credential paths.
Between 09:14 and 14:55 UTC, the actor used 102 AWS IP addresses located in the ca-central-1 region to clone up to thousands of repositories per organization.
Repository exfiltration should be treated as more than source code theft. Repositories frequently contain cloud credentials, SaaS tokens, internal documentation, private keys, and sensitive data that can significantly increase the impact of a compromise.
56% of company-impacting secrets lived in employees' personal repositories, where most security programs have no visibility.
Builds on: 2026-08-15/trivy-not-litellm-behind-2500-org-credential-collection · 2026-08-10/coding-agent-forensic-artefacts-opencode-codex-credentials · 2026-08-10/coding-agent-ci-harness-trust-boundary-shared-checkout