> GitHub Security identified unauthorized access to our npm production infrastructure using a compromised AWS API key. Based on subsequent analysis, we believe this API key was obtained by the attacker when they downloaded a set of private npm repositories Don't push your aws access keys to vcs, npm or anywhere. Scary that github does (did) that

Apparently it was a long-lived access key that had access to prod infra 🙈

No mfa either

Very interesting... Can you elaborate more about it? Especially with the art context?