Update: Nearly 100,000 NPM Users’ credentials stolen in the April GitHub OAuth token attack

The attackers abused stolen OAuth user tokens issued to two third-party OAuth integrators, Heroku and Travis-CI, to download data from dozens of organizations, including npm.