GitHub breach exposes 3,800 repos after employee installs poisoned VS Code extension

GitHub Confirms Major Security Incident

GitHub confirmed on May 20 that a poisoned VS Code extension installed on an employee's device gave attackers access to approximately 3,800 internal repositories at the Microsoft-owned platform 1

1

2

2

. The GitHub breach began when an employee downloaded a malicious Visual Studio Code extension from the official VS Code Marketplace, marking one of the most significant security incidents the company has ever disclosed. That single installation was enough to give the attacker access to the employee's device and, from there, to thousands of private repositories containing proprietary source code and internal organization files.

TeamPCP Cybercrime Group Claims Responsibility

The cybercrime group TeamPCP, formally tracked by Google Threat Intelligence Group as UNC6780, claimed credit for the attack on the Breached hacking forum, where it offered the stolen data for at least $50,000 1

1

2

2

. The group threatened to leak the material if no buyer materialized. GitHub's assessment confirmed that the attacker's claim of roughly 3,800 internal repositories stolen was "directionally consistent" with its own investigation findings. TeamPCP has built a formidable track record in supply chain attacks targeting open-source security utilities and AI middleware, including previous compromises of Aqua Security's Trivy vulnerability scanner, Checkmarx's KICS, the LiteLLM AI gateway library, TanStack, and packages associated with MistralAI 1

1

.

Swift Response and Containment Measures

GitHub moved quickly once it detected the intrusion, isolating the compromised device, removing the extension, and rotating critical credentials within hours 2

2

. The company stressed that the activity involved data exfiltration of internal repositories only and that it had found no evidence of impact to customer data, enterprise accounts, or user-hosted repositories. GitHub posted about the cybersecurity incident on X, stating: "We removed the malicious extension version, isolated the endpoint, and began incident response immediately" 2

2

. Critical secrets were rotated overnight with the highest-impact credentials prioritized first.

Broader Wave of Supply Chain Attacks

The GitHub breach did not occur in isolation. It arrived the same day a new Mini Shai-Hulud wave forged valid cryptographic provenance on 639 malicious npm package versions, one day after attackers compromised a VS Code extension with 2.2 million installs, and the same day Wiz discovered TeamPCP had compromised Microsoft's Python SDK on PyPI 2

2

. Trend Micro, StepSecurity, and Snyk have formally tracked TeamPCP across at least seven waves of the Mini Shai-Hulud supply chain worm since March, targeting developer tools and poisoning developer tools that organizations depend on.

Vulnerability of Developer Tools Exposed

The supply chain attack underscores how browser and editor extensions often receive broad system permissions by default, making them particularly attractive to attackers seeking lateral access 1

1

. GitHub has not named the specific extension involved in its breach, and it remains unclear whether the extension was a newly published malicious listing or a compromised version of a legitimate tool. For GitHub, which hosts more than 100 million developers and serves as critical infrastructure for the global software industry, the breach raises uncomfortable questions about the security of the tools developers trust implicitly. Internal repositories contain infrastructure configurations, deployment scripts, staging credentials, and internal API schemas—making this not just a data breach but an infrastructure intelligence leak 2

2

.

What Organizations Should Watch For

Binance co-founder CZ posted immediately after the disclosure: "If you have ANY private repos with plain text secrets or sensitive documents/architectures, immediately rotate your secrets" 2

2

. Peyton Kennedy, senior security researcher at Endor Labs, noted that "TanStack had the right setup on paper: OIDC trusted publishing, signed provenance, 2FA on every maintainer account. The attack worked anyway" 2

2

. This suggests that even organizations with robust security measures face significant risks from poisoned developer tools. GitHub said its investigation is ongoing, with external forensics support engaged to determine the full scope of the data accessed. TeamPCP shows no signs of slowing down, demonstrating a consistent playbook: poison the tools that organizations depend on, and the perimeter becomes irrelevant 1

1

.🟡 injurious_images='[]', summary_with_images='### GitHub Confirms Major Security Incident

GitHub confirmed on May 20 that a poisoned VS Code extension installed on an employee's device gave attackers access to approximately 3,800 internal repositories at the Microsoft-owned platform 1

1

2

2

. The GitHub breach began when an employee downloaded a malicious Visual Studio Code extension from the official VS Code Marketplace, marking one of the most significant security incidents the company has ever disclosed. That single installation was enough to give the attacker access to the employee's device and, from there, to thousands of private repositories containing proprietary source code and internal organization files.

TeamPCP Cybercrime Group Claims Responsibility

The cybercrime group TeamPCP, formally tracked by Google Threat Intelligence Group as UNC6780, claimed credit for the attack on the Breached hacking forum, where it offered the stolen data for at least $50,000 1

1

2

2

. The group threatened to leak the material if no buyer materialized. GitHub's assessment confirmed that the attacker's claim of roughly 3,800 internal repositories stolen was "directionally consistent" with its own investigation findings. TeamPCP has built a formidable track record in supply chain attacks targeting open-source security utilities and AI middleware, including previous compromises of Aqua Security's Trivy vulnerability scanner, Checkmarx's KICS, the LiteLLM AI gateway library, TanStack, and packages associated with MistralAI 1

1

.

Swift Response and Containment Measures

GitHub moved quickly once it detected the intrusion, isolating the compromised device, removing the extension, and rotating critical credentials within hours 2

2

. The company stressed that the activity involved data exfiltration of internal repositories only and that it had found no evidence of impact to customer data, enterprise accounts, or user-hosted repositories. GitHub posted about the cybersecurity incident on X, stating: "We removed the malicious extension version, isolated the endpoint, and began incident response immediately" 2

2

. Critical secrets were rotated overnight with the highest-impact credentials prioritized first.

Broader Wave of Supply Chain Attacks

The GitHub breach did not occur in isolation. It arrived the same day a new Mini Shai-Hulud wave forged valid cryptographic provenance on 639 malicious npm package versions, one day after attackers compromised a VS Code extension with 2.2 million installs, and the same day Wiz discovered TeamPCP had compromised Microsoft's Python SDK on PyPI 2

2

. Trend Micro, StepSecurity, and Snyk have formally tracked TeamPCP across at least seven waves of the Mini Shai-Hulud supply chain worm since March, targeting developer tools and poisoning developer tools that organizations depend on.

Vulnerability of Developer Tools Exposed

The supply chain attack underscores how browser and editor extensions often receive broad system permissions by default, making them particularly attractive to attackers seeking lateral access 1

1

. GitHub has not named the specific extension involved in its breach, and it remains unclear whether the extension was a newly published malicious listing or a compromised version of a legitimate tool. For GitHub, which hosts more than 100 million developers and serves as critical infrastructure for the global software industry, the breach raises uncomfortable questions about the security of the tools developers trust implicitly. Internal repositories contain infrastructure configurations, deployment scripts, staging credentials, and internal API schemas—making this not just a data breach but an infrastructure intelligence leak 2

2

.

What Organizations Should Watch For

Binance co-founder CZ posted immediately after the disclosure: "If you have ANY private repos with plain text secrets or sensitive documents/architectures, immediately rotate your secrets" 2

2

. Peyton Kennedy, senior security researcher at Endor Labs, noted that "TanStack had the right setup on paper: OIDC trusted publishing, signed provenance, 2FA on every maintainer account. The attack worked anyway" 2

2

. This suggests that even organizations with robust security measures face significant risks from poisoned developer tools. GitHub said its investigation is ongoing, with external forensics support engaged to determine the full scope of the data accessed. TeamPCP shows no signs of slowing down, demonstrating a consistent playbook: poison the tools that organizations depend on, and the perimeter becomes irrelevant 1

1

.