CODEWITHSUNDEEP
githubgithub-package-registry
Pegos
Pegos

Reputation: 183

Publish npm secret key in public repository

i have question about github.

I published npm secret key in public repository and github deleted this key. But i don't understand, someone could see this key and have time to download my packages?

Upvotes: 0

Views: 207

Answers (1)

bk2204
bk2204

Reputation: 76804

As the GitHub documentation states, any secrets you push to a repository must be considered to be compromised. There are services which do scan repositories for secrets with the attempt to exploit them immediately.

If you're concerned about whether someone's misused those credentials, you can see if npm has a list of recent actions taken with that token and see if it was used by someone other than you. Barring that, you just have to assume that someone did indeed have the access of that token during the time it was exposed and do appropriate forensics investigations.

Upvotes: 1

Related Questions