"On April 12, GitHub Security began an investigation that uncovered evidence that an attacker abused stolen OAuth user tokens issued to two third-party OAuth integrators..."

Too vague to be useful. Stolen from whom? Simultaneously from two different third parties? The whole thing began April 12? Based on what signal and from whom?

Here's what this vagueness tells me: GitHub OAuth token management for integrators is badly operated and poorly monitored by the entity issuing tokens.

My conclusion is that Microsoft (GitHub), SalesForce (Heroku), and Idera (TA Associate, Travis CI) have not learned the SolarWinds lessons of Supply Chain Security yet. Perhaps this will be the incident that helps.

Some of the posts in this thread are a little too c'est la vie for my tastes.