GitHub Mass Repository Breach: 5,500 Private Repos Made Public in S1ngularity Phase 2 Attack

What happened in Phase 2

• Automation and window: Researchers observed a scripted, single-threaded job that iterated through compromised accounts and toggled private repos to public over an ~10-hour span (Aug 28–29), using the victims’ own GitHub Personal Access Tokens (PATs)/OAuth tokens stolen in Phase 1.ctoatncsc.substack+1

• Scale: Over 5,500 private repositories were published publicly, affecting more than 400 users/orgs; this followed Phase 1 exfiltration where thousands of public “s1ngularity-repository” repos were created in victim accounts with results.b64 data.wiz+1

How Phase 1 enabled Phase 2

• Phase 1 mechanics: Malicious Nx packages (postinstall payloads) harvested local secrets and used the victim’s GitHub token to create public repos (s1ngularity-repository*) and commit base64-encoded files (results.b64) containing keys, tokens, and inventory data.stepsecurity+1

• Token reuse: Many GitHub tokens remained valid after Phase 1; the actor reused those tokens to call GitHub APIs to modify repository visibility en masse in Phase 2, escalating data exposure to full source code, issues, wiki, and release assets.devops+1

Technical analysis: visibility manipulation

• Likely API path: Authenticated calls to repository endpoints (e.g., PATCH on repos/{owner}/{repo}) to set visibility=public, iterating over lists of repos obtained via the same tokens; audit trails should show a burst of “private→public” events from unusual IPs or atypical automation patterns.devops

• Automation signature: Linear, single-threaded sequence, suggesting a simple loop with error handling rather than concurrent jobs; organizations will see serialized timestamp patterns across many repos.devops

Impact on IP and compliance

• Intellectual property: Full exposure of source code, build scripts, IaC, and internal documentation risks competitive leakage, exploit development against revealed services, and supply-chain poisoning of downstream users.devops

• Credentials and tokens: Private repos commonly store environment files, CI/CD variables, and provider keys; any embedded secrets compound risk beyond code disclosure.stepsecurity+1

• Regulatory: Depending on repository contents, may trigger incident reporting obligations (e.g., customer data in code samples or test fixtures), contractual disclosures, and potential export-control reviews.ctoatncsc.substack

GitHub security response timeline (observed)

• Aug 27 (Phase 1 response): GitHub disabled attacker-created s1ngularity-repository public repos under victim accounts; however, many stolen tokens remained valid prior to Phase 2.wiz

• Aug 28–29 (Phase 2): Publicization of >5,500 private repos across 400+ users/orgs by automated script until suspension/intervention; victims needed to re-privatize, rotate tokens, and review forks.ctoatncsc.substack+1

Who may be affected

• Any developer/org that installed compromised Nx packages during the Aug 26–27 window (local dev, CI runners, or through the Nx VS Code extension), especially those with cached tokens and broad repo scopes.endorlabs+1

• Orgs with fine-grained tokens disabled or permissive classic PATs may have suffered broader repo-visibility changes; review audit logs for mass visibility updates and unknown repo creations.stepsecurity+1

Immediate containment and investigation

• Tokens first

  • Revoke all GitHub PATs/OAuth apps issued to impacted users/runners between Aug 26–29; force re-auth and convert to fine-grained tokens with least privilege; require SSO-bound tokens.devops

• Repo state and exposure

  • Enumerate repos switched to public in the time window; re-privatize, disable GitHub Pages if enabled, and purge cached artifacts; search for unauthorized forks; file takedowns where appropriate.devops

• Forensics

  • Pull GitHub org audit logs for “visibility change,” “repo.create,” “repo.publicized,” and unusual API caller IPs/UA strings; correlate with npm install/postinstall events on CI; snapshot any exposed secrets in commits/issues.stepsecurity+1

Private repository protection strategies

• Default-deny visibility: Enforce org policies preventing public repo creation or visibility changes without admin approval; use GitHub Enterprise policies and branch/release protection.ctoatncsc.substack

• Secret hygiene: Mandate pre-commit secret scanning, enable GitHub Advanced Security secret scanning with org-wide push protection, and block merges on secret findings; rotate all secrets found in history.ctoatncsc.substack

• Repo provenance: Require signed commits (GPG/Sigstore), protected branches, and mandatory reviews; prevent force pushes to protected branches to limit tampering post-restoration.ctoatncsc.substack

Token management best practices

• Fine-grained tokens: Replace classic PATs with scoped, time-bounded, SSO-enforced tokens; prefer GitHub App tokens for CI with minimal repo scopes; vault-manage all credentials.ctoatncsc.substack

• Rotation and detection: Automate rotation on schedule and on incident; enable org-wide detection for token leakage (secret scanning + push protection); alert on anomalous token usage origins.devops

• Runner isolation: Use ephemeral CI runners with no long-lived tokens; block npm postinstall scripts in CI (npm ci --ignore-scripts) and pin package versions with lockfiles.endorlabs

Alfaiz Nova Enterprise Security Guide: GitHub org hardening

• Access control

  • Enforce SSO for org access; require 2FA/FIDO2 for all members; disable classic PATs org-wide; mandate fine-grained tokens and GitHub Apps for automation.

• Repository governance

  • Disallow public repos by default; restrict visibility changes to org owners; enforce CODEOWNERS, branch protections, and required reviews/signatures; enable secret scanning and Dependabot alerts org-wide.

• Supply-chain guardrails

  • Pin dependencies with lockfiles; enable npm provenance/attestations where possible; mirror/verify registries for build; block postinstall in CI; run SCA/SAST on PRs; quarantine packages with unusual postinstall telemetry.

• Monitoring and response

  • Stream audit logs to SIEM; alert on bursts of repo.visibility changes and unexpected repo.create; maintain playbooks for “mass publicization” including rapid re-privatization, secret rotation, and takedown requests.

Sources

• Wiz post-incident analysis of Phase 2 mass-publicization (>5,500 repos, >400 users/orgs) and automation window.devops

• S1ngularity Phase 1 mechanics and GitHub disabling attacker-created repos under victim accounts.wiz

• Nx advisory and supply-chain compromise details; CI and package hygiene mitigations.github+1