GitHub private repositories accessed with stolen Heroku and Travis CI OAuth tokens
GitHub disclosed on April 15, 2022 that an attacker used stolen OAuth user tokens issued to Heroku and Travis CI to download data from private repositories of dozens of organizations, including npm. Heroku found the attacker had used a compromised token for a Heroku machine account, taken from an archived private repository, to download customer GitHub integration OAuth tokens from a Heroku database on April 7, 2022.
- Victim
- Multiple: GitHub, npm, Heroku and dozens of organizations
- Industry
- Technology
- Country
- United States
- Intrusion began
- Apr 7, 2022
- First disclosed
- Apr 15, 2022
- Actor
- Unattributed
- Initial access
- OAuth token abuse
- Identity control that failed
- Non-human identity
- MFA
- Not applicable (no interactive login)
- Abused identity
- Non-human (service account, token, key or app)
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
Third-party integration tokens are standing access to your code; short lifetimes, least-scope grants and anomaly detection on token use would have contained this.
Go deeper on SWI
- Technique: Secrets in repositories and CI
Sources
- Security alert: Attack campaign involving stolen OAuth user tokens issued to two third-party integrators, GitHub, Apr 15, 2022
- April 2022 Incident Review, Heroku, May 31, 2022
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Malwarebytes email access via abused Microsoft 365 application 2021 · OAuth token abuse
- LiteLLM poisoned PyPI and Docker release traced to a leaked, never-revoked admin key 2026 · Exposed secrets
- CrowdSec private repositories copied with a departing engineer's GitHub token 2026 · OAuth token abuse
- Shai-Hulud 2.0 npm worm exposes credentials in 25,000+ repositories 2025 · Supply chain
Cite this record
SWI Community Team. (2026). GitHub private repositories accessed with stolen Heroku and Travis CI OAuth tokens. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2022-github-heroku-travis-oauth-tokens/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.