Three developer-credential findings this week each show an estate auditing the wrong thing — the wrong package, the wrong incident class, and repositories nobody counted as company assets at all
Supply-chain research usually asks how the attacker got in. Three findings this week ask a different question, and give the same unwelcome answer: the organisations that responded to these incidents looked in the wrong place, and their audits came back clean for that reason.
The clearest case is a correction to a story most estates have already closed. SOCRadar re-analysed the exposure dataset behind the widely reported compromise of around 2,500 organisations through LiteLLM and found that 2,085 of the 2,188 identified organisations — 95% — show collection activity beginning before the poisoned LiteLLM packages reached PyPI on 24 March. The collection instead tracks the compromise of Aqua Security's Trivy scanner, whose poisoned release LiteLLM's own continuous-integration pipeline pulled unpinned (SOCRadar, 2026-08-13), a re-attribution SecurityWeek reported independently (SecurityWeek, 2026-08-14). The operational consequence is specific and awkward: an estate that asked "did we install the affected LiteLLM versions on 24 March" asked about the wrong package on the wrong date, got a negative answer, and closed a genuine exposure. The artefact that actually needed auditing is a security scanner — a tool most CI pipelines pull by mutable tag precisely because it is a security tool and expected to be current.
Wiz's Customer Incident Response Team published the second, a technical playbook for a campaign run against multiple customer organisations that abused compromised GitHub Personal Access Tokens for mass repository exfiltration. The attack shape is worth knowing because it is loud in exactly one place: reconnaissance through GitHub API queries to enumerate everything the token could reach, a small number of validation clones, then bulk theft — "Between 09:14 and 14:55 UTC, the actor used 102 AWS IP addresses located in the ca-central-1 region to clone up to thousands of repositories per organization" (Wiz, 2026-08-13). Wiz's framing is the part that changes response practice: "Repository exfiltration should be treated as more than source code theft. Repositories frequently contain cloud credentials, SaaS tokens, internal documentation, private keys, and sensitive data that can significantly increase the impact of a compromise." An organisation that scopes this as intellectual-property loss writes a legal assessment; an organisation that scopes it as a secrets incident rotates cloud credentials and hunts for their use, which is the difference between the incident ending and continuing. A companion Wiz post reports that across the Forbes AI 50 the firm found "56% of company-impacting secrets lived in employees' personal repositories, where most security programs have no visibility" (Wiz, 2026-08-13) — a third scoping error, this time in what counts as a company asset at all.
The week's third finding supplies the substrate the other two run on. CERT Intrinsec's forensic-artefact series for autonomous coding-agent command-line tools documents that these tools write their state to predictable per-user paths — OpenCode keeping a database of sessions, messages and workspaces alongside a file holding authentication information including API keys, and OpenAI Codex keeping authentication material in auth.json with the operator's prompt history in history.jsonl (CERT Intrinsec, 2026-07-31). Read as an investigator's map that is useful; read as an attacker's inventory it says that any foothold on a developer or build host now reaches cleartext provider credentials at a known location, without touching a keychain or a secrets manager.
Triage: the GitHub-side observable is a shape rather than an indicator, and it is one legitimate tooling does not produce. Enterprise audit-log events showing a single token or principal issuing a burst of repository-clone or archive-download calls, spanning many repositories including ones that principal has never touched, from source addresses distributed across a narrow cloud-provider range within a short window, is anomalous by construction: continuous-integration systems clone repeatedly but from a small, stable set of known egress addresses and against the repositories they build, and a developer clones interactively at human rates. The preceding phase is quieter and worth pairing with it — a rise in API enumeration calls from a token that normally only clones. On developer and build hosts, the corresponding host-side signal is any process other than the agent itself reading those documented credential paths.
Between 09:14 and 14:55 UTC, the actor used 102 AWS IP addresses located in the ca-central-1 region to clone up to thousands of repositories per organization.
Repository exfiltration should be treated as more than source code theft. Repositories frequently contain cloud credentials, SaaS tokens, internal documentation, private keys, and sensitive data that can significantly increase the impact of a compromise.
56% of company-impacting secrets lived in employees' personal repositories, where most security programs have no visibility.
ATT&CK mapping
7 techniques mapped from the cited reporting · MITRE ATT&CK v19.2
Initial Access TA0001
T1078.004Valid Accounts: Cloud Accounts
Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.
T1195.002Supply Chain Compromise: Compromise Software Supply Chain
Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version.
Persistence TA0003
T1078.004Valid Accounts: Cloud Accounts
Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.
Privilege Escalation TA0004
T1078.004Valid Accounts: Cloud Accounts
Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.
Stealth TA0005
T1078.004Valid Accounts: Cloud Accounts
Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.
Credential Access TA0006
T1552.001Unsecured Credentials: Credentials In Files
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
T1552.005Unsecured Credentials: Cloud Instance Metadata API
Adversaries may attempt to access the Cloud Instance Metadata API to collect credentials and other sensitive data.
Lateral Movement TA0008
T1550.001Use Alternate Authentication Material: Application Access Token
Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users or services and used in lieu of login credentials.
Collection TA0009
T1213.003Data from Information Repositories: Code Repositories
Adversaries may leverage code repositories to collect valuable information. Code repositories are tools/services that store source code and automate software builds. They may be hosted internally or privately on third party sites such as Github, GitLab, SourceForge, and BitBucket. Users typically interact with code repositories through a web application or command-line utilities such as git.
Exfiltration TA0010
T1567Exfiltration Over Web Service
Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services.
Sources
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.