So this is not the post about the Musk Twitter bid. Everybody and their cousin is writing that post this week and I don't have anything to add to it that you haven't already read four times. What I do want to talk about is the GitHub security notice that went out a few days ago, because it actually broke something on my machine and cost me an evening I didn't plan on losing.
Short version: GitHub put out an alert saying an attacker got hold of stolen OAuth tokens that had been issued to Heroku and Travis-CI, and used them to go pull data out of a bunch of private repos across dozens of organizations. npm was one of the affected orgs, which is the part that made this feel a little less abstract than your average "there was an incident" post. GitHub's response was to revoke the tokens tied to those two apps, full stop, for everyone, whether your org was touched or not.
Which is the responsible thing to do. I'm not arguing with the call. But it means if you had the Heroku GitHub integration wired up for auto-deploys, like I do on a side project that pushes to a free dyno whenever I merge to main, that integration just stopped working with zero warning. I found out because a push sat there Tuesday night and nothing happened. No deploy, no error in my inbox, nothing. I only figured out why after seeing a thread about it, went and checked Heroku's dashboard, and sure enough the GitHub connection was sitting there disconnected like it had never been set up in the first place.
Reconnecting took maybe ten minutes once I knew what was going on, so it's not a huge deal in isolation. What bugs me is the bigger pattern underneath it, which is that we've all just quietly agreed to hand a pile of third-party services standing OAuth access to our source code, and most of us couldn't tell you offhand which services those are or what scopes we granted them two years ago. I went and looked at my own GitHub authorized apps list after this and there were entries on there I genuinely didn't recognize. One was some CI thing I used for a single hackathon project in 2019 and never revoked. That's on me, not GitHub, but I doubt I'm unusual here.
The npm angle is the part that actually worries me a little more than my broken dyno. npm has been a soft target for years, going back to the event-stream incident and the left-pad fiasco before that, and any time there's a "someone got access to npm internals" headline my first reaction is to wonder what packages I've got sitting in node_modules on client projects that I haven't audited in months. I don't think anything catastrophic came out of this particular breach on the package side, from what's been said so far, but "from what's been said so far" is doing a lot of work in that sentence and we probably won't know the full shape of it for a while.
If you're running any of the usual CI integrations, this is a decent excuse to go actually look at your GitHub authorized apps page instead of ignoring it like I had been. Takes about ninety seconds. Revoke anything you don't recognize, and if a build or deploy suddenly goes quiet on you this week, check your integrations before you assume it's your own code that's broken, because that's exactly what I assumed at first and I wasted twenty minutes staring at a Procfile that was completely fine.
Unrelated, but since I'm already complaining: Heroku's free tier dynos have been getting slower to wake from sleep lately and I can't tell if that's my imagination or an actual change on their end. If anyone else has noticed the same thing, let me know, because I've been half-considering moving that project to Render just out of spite.
Anyway. Go check your OAuth apps. Reconnect whatever broke. That's the whole post.