A leaked GitHub token from Novo Nordisk has exposed a critical vulnerability in the pharmaceutical giant's software development pipeline, according to cybersecurity researchers. The breach underscores a fundamental misstep many organizations make: treating secrets management as a tooling problem rather than an identity problem.
The incident, reported by Dark Reading, reveals how an exposed token could allow attackers to infiltrate the development pipeline, potentially compromising code integrity and sensitive systems. While the full scope of the breach remains unclear, the discovery highlights the growing risk associated with credential leakage in high-stakes environments like healthcare and pharmaceuticals.
Attack vectors in such cases typically involve attackers scanning public repositories or logs for exposed tokens, which then grant unauthorized access to private codebases, continuous integration/continuous deployment (CI/CD) pipelines, or cloud infrastructure. This method bypasses traditional perimeter defenses by targeting the software supply chain itself.
Mitigation requires shifting from a tooling-centric approach—where secrets are stored in vaults but still handled insecurely—to an identity-centric model. This means treating every secret as an identity credential that should be tied to specific roles, rotated frequently, and monitored for anomalous usage. No specific patches were detailed, but organizations are urged to audit token exposure and enforce least-privilege policies.
The broader lesson is that secrets management failures are not isolated to any single industry. As software supply chain attacks increase, the Novo Nordisk case serves as a reminder that robust identity governance must extend beyond traditional authentication to encompass every automated process that relies on tokens or keys.