On 6 December 2022, an attacker used a compromised personal access token (PAT) belonging to a GitHub machine account to clone repositories from GitHub's own Atom, Desktop and other deprecated organisations. GitHub detected it the next day and revoked the credentials. None of the repositories held customer data, but some contained encrypted, password-protected code signing certificates used by GitHub Actions to sign GitHub Desktop and Atom releases: two DigiCert certificates for Windows and an Apple Developer ID certificate valid until 2027. GitHub said it had no evidence the certificates were decrypted or misused. As a precaution it re-signed GitHub Desktop with new certificates on 4 January 2023 and revoked the exposed ones on 2 February 2023, which stopped some older Desktop for Mac and Atom versions from working.
Key takeaways
- The entry point was a machine credential: a compromised PAT associated with a machine account, which GitHub has not said how was compromised.
- The token was enough to clone repositories from GitHub's Atom, Desktop and other deprecated organisations on 6 December 2022; GitHub revoked it on 7 December.
- The repositories stored encrypted code signing certificates for Desktop and Atom release workflows, so the theft reached into GitHub's software supply chain.
- GitHub found no evidence of decryption or malicious use, but revoked three certificates and invalidated Desktop for Mac 3.0.2 to 3.1.2 and Atom 1.63.0 to 1.63.1.
- The identity lesson: automation tokens with broad repository access, and signing keys stored beside code, are high-value targets that need tight scope and short lives.
At a glance
| Organisation | GitHub (GitHub Desktop and Atom projects) |
|---|---|
| When | Repositories cloned 6 December 2022; detected and credentials revoked 7 December 2022; disclosed 30 January 2023; certificates revoked 2 February 2023 |
| Attacker | Unknown |
| Entry point | A compromised personal access token associated with a GitHub machine account |
| Identities abused | The machine account's PAT; encrypted code signing certificates (two DigiCert Windows certificates and one Apple Developer ID certificate) stored in the cloned repositories |
| Impact | Repositories cloned and signing certificates exposed; no customer data, no unauthorised code changes and no evidence of certificate misuse, according to GitHub; affected app versions stopped working after revocation |
| Category | NHI. Incident class: confirmed NHI breach (machine account token abused; signing certificates exposed) |
What happened
"On December 6, 2022, repositories from our atom, desktop, and other deprecated Github-owned organizations were cloned by a compromised Personal Access Token (PAT) associated with a machine account," GitHub said, as quoted by BleepingComputer. "Once detected on December 7, 2022, our team immediately revoked the compromised credentials and began investigating potential impact to customers and internal systems. None of the affected repositories contained customer data." GitHub has not said how the token was compromised.
The cloned repositories did hold something sensitive: several encrypted code signing certificates stored for use via GitHub Actions in the Desktop and Atom release workflows. "The certificates were password-protected and we have no evidence of malicious use. As a preventative measure, we will revoke the exposed certificates used for the GitHub Desktop and Atom applications," GitHub said, according to SecurityWeek. If decrypted, such certificates could let an attacker sign software that appeared to come from GitHub.
The exposed certificates were two DigiCert code signing certificates for Windows, one of which expired on 4 January 2023 and the other on 1 February 2023, and an Apple Developer ID certificate valid until 2027. GitHub worked with Apple to monitor for new executables signed with it. On 4 January 2023 GitHub released a new version of the Desktop app "signed with new certificates that were not exposed to the threat actor." It removed Atom 1.63.0 and 1.63.1 from its releases page and announced on 30 January that on 2 February it would revoke the certificates, invalidating GitHub Desktop for Mac 3.0.2 to 3.1.2 and Atom 1.63.0 to 1.63.1. GitHub said there was no risk to GitHub.com services and no unauthorised changes to the projects.
Timeline
| Date | Event |
|---|---|
| 6 December 2022 | Repositories from GitHub's Atom, Desktop and deprecated organisations are cloned with a machine account's compromised PAT. |
| 7 December 2022 | GitHub detects the activity and revokes the compromised credentials. |
| 4 January 2023 | GitHub releases a new Desktop version signed with new certificates. |
| 30 January 2023 | GitHub discloses the incident and announces certificate revocation. |
| 2 February 2023 | GitHub revokes the exposed Mac and Windows signing certificates. |
How it happened: the identity attack path
- Machine account token compromised. A PAT tied to a GitHub machine account fell into an attacker's hands by an undisclosed route.
- Broad repository reach. The token could read repositories across several GitHub-owned organisations, including Atom and Desktop.
- Bulk cloning. The attacker cloned those repositories on 6 December 2022.
- Signing material exposed. The repositories contained encrypted code signing certificates used by release workflows.
- Revocation as the fix. Because the certificates could not be recalled, GitHub replaced and revoked them, breaking older signed app versions.
Impact
- Confirmed: repositories cloned and three code signing certificates exposed in encrypted form.
- Not found by GitHub: customer data exposure, unauthorised changes to projects, risk to GitHub.com or malicious use of the certificates.
- User impact: GitHub Desktop for Mac 3.0.2 to 3.1.2 and Atom 1.63.0 to 1.63.1 stopped working after revocation; users had to update or downgrade.
What this means for NHI governance
A machine account token did the damage here. Automation accounts are often created for one job and given broad access to make that job easy, and their tokens are long-lived because nobody wants a build to break. When such a token is compromised, it reaches everything the automation could reach, across organisations, without MFA or human behaviour to flag it.
The certificates show the second risk. Signing keys stored alongside code, even encrypted, turn a repository theft into a supply chain concern, because the fix for exposed signing keys is revocation, which breaks software already in users' hands. Keeping signing keys in hardware or a managed signing service, and scoping automation tokens to single repositories, would have limited both. See our Machine Identity, PKI and Certificate Lifecycle Guide and CI/CD Pipeline Identity Security Guide.
Recommendations
- Scope machine account tokens narrowly. Use fine-grained tokens limited to specific repositories and actions, with expiry dates. See the CI/CD Pipeline Identity Security Guide.
- Prefer short-lived, federated credentials for automation. Replace stored PATs with workload identity or OIDC where the platform supports it.
- Keep signing keys out of repositories. Use hardware security modules or a managed signing service so keys cannot be copied with the code. See the Machine Identity, PKI and Certificate Lifecycle Guide.
- Monitor machine accounts for unusual cloning. Bulk cloning across organisations by an automation account should raise an alert.
- Plan certificate revocation in advance. Know which releases each certificate signed so you can re-sign and revoke without surprises.
Frequently asked questions
What was stolen from GitHub in December 2022?
An attacker cloned repositories from GitHub's Atom, Desktop and other deprecated organisations using a machine account's compromised token. The repositories contained encrypted code signing certificates for GitHub Desktop and Atom, but no customer data.
Were the GitHub signing certificates misused?
GitHub said the certificates were password-protected and it had no evidence of malicious use. It revoked them on 2 February 2023 as a precaution.
Which apps stopped working after the revocation?
GitHub Desktop for Mac versions 3.0.2 to 3.1.2 and Atom versions 1.63.0 and 1.63.1. GitHub Desktop for Windows was not affected.
Related NHI Mgmt Group resources
GitHub OAuth Token Breach 2022 · Slack GitHub Breach 2022 · Machine Identity, PKI and Certificate Lifecycle Guide · CI/CD Pipeline Identity Security Guide · Service Account Security Guide
How NHI Mgmt Group can help
Machine accounts and their tokens rarely get the review that human admins do. We help teams inventory automation identities, scope their tokens and move signing keys into protected services. See our NHI and AI agent security training.
References
- BleepingComputer: GitHub revokes code signing certificates stolen in repo hack (30 January 2023)
- SecurityWeek: GitHub Revokes Code Signing Certificates Following Cyberattack (31 January 2023)
- Security Affairs: GitHub to revoke stolen code signing certificates for GitHub Desktop and Atom (31 January 2023)