The Breach is Over - The Exposure is Not

The talk, given by Anant Srivastava alone after his co-presenter could not attend, looks past the usual end of a supply chain incident. It describes the two Shai-Hulud npm worm waves, which stole secrets from developer machines and CI systems. The second wave used GitHub as its drop point, reusing tokens from earlier dumps to create new repositories, and roughly 35,000 repositories were tracked. Later campaigns encrypted their uploads to slow down casual copying.

The speaker then reports how long the exposure lasted. From a sample of first-wave repositories, most GitHub tokens were still live close to a year later, and their private repositories had been made the only change. A later verified scan of second-wave data still found about 150,000 active credentials. He also found about 542 working SSH keys across GitHub, Bitbucket, GitLab and Hugging Face. Git hosts reveal usernames on SSH login, which makes enumeration easy, and common scanners cover only a few hundred patterns, so self-hosted secrets are missed. Environment variable names such as k8s-prod also disclosed infrastructure details.

A canary AWS credential planted in a decoy repository was used within days. Attacker calls moved from identity checks to targeted queries for models and secrets, with boto3 as the most common user agent. The takeaway is to measure recovery by whether usable exposure disappears, not by whether the original incident is closed. Practitioners should map each credential's blast radius, shorten token lifetimes and cut permissions.