GitHub Breach: 3,800 Internal Repos Stolen via VS Code Extension

Key Takeaways

• Attackers compromised a GitHub employee's device using a malicious VS Code extension
• Data from approximately 3,800 internal repositories was stolen
• TeamPCP claims responsibility and is selling the data on a cybercrime forum

GitHub confirmed on Tuesday that hackers breached its systems and stole data from approximately 3,800 internal code repositories. The attack vector: a poisoned Visual Studio Code extension that compromised an employee's device.

The Microsoft-owned developer platform disclosed the incident through a series of posts on X, stating it has "no evidence of impact to customer information stored outside of GitHub's internal repositories." The investigation remains ongoing.

The Attack Method

GitHub said it "detected and contained a compromise of an employee device involving a poisoned VS Code extension." Visual Studio Code is one of the most popular code editors among developers, and its extension marketplace has become a growing target for attackers.

The company has not named the compromised extension. This matters because thousands of developers might still have it installed.

Malicious code extensions represent a rising threat in software supply chains. By compromising a popular open-source tool or extension, attackers gain access to vast numbers of developer machines in a single operation. The downstream effects can be severe: stolen credentials, compromised code signing keys, and backdoors inserted into production software.

Who's Behind It

A hacking group called TeamPCP has claimed credit for the breach, according to reports from The Record and Bleeping Computer. The group is reportedly selling the stolen data on a cybercrime forum.

GitHub has not responded to questions about whether it received any communication from the hackers, including ransom demands.

TeamPCP has a track record. The group previously claimed responsibility for a data breach at the European Commission that resulted in the theft of more than 90 gigabytes of data. In that attack, hackers stole cloud keys during an earlier breach at Trivy, a vulnerability scanning tool, by pushing info-stealing malware to Trivy's downstream users.

A Pattern of Supply Chain Attacks

The GitHub breach fits a troubling pattern. OpenAI was targeted recently in a similar attack that compromised Tanstack, a platform used by web developers. Hackers pushed malicious updates through Tanstack that stole passwords and authentication tokens from users.

These attacks share a common logic: instead of attacking thousands of targets individually, compromise a trusted tool that all of them use. Developer tools are particularly valuable targets because they often run with elevated privileges and have access to source code, deployment keys, and cloud credentials.

What GitHub Says Is Safe

GitHub emphasized that customer data stored outside its internal repositories appears unaffected. This distinction matters: GitHub hosts code for millions of organizations, and a breach of customer repositories would be catastrophic.

Internal repositories typically contain GitHub's own tooling, infrastructure code, and proprietary systems. While this data has value to attackers, particularly for finding additional vulnerabilities, it's different from exposing customer source code directly.

That said, "investigation ongoing" means the full scope isn't known yet. Companies often discover broader impact as forensic analysis continues.

What Teams Should Do Now

• Audit VS Code extensions across your organization. Remove any that aren't actively needed.
• Review extension permissions. Some extensions request far more access than their function requires.
• Enable extension signing verification where available.
• Check for unusual activity in your GitHub organization's audit logs.
• Rotate credentials if your team used any recently flagged extensions.

Frequently Asked Questions

Was customer source code exposed in the GitHub breach?

GitHub says there's no evidence of impact to customer information stored outside internal repositories. Only GitHub's own internal code appears affected, though the investigation continues.

Which VS Code extension was compromised?

GitHub has not disclosed the name of the malicious extension. This information would help developers check their own systems.

Who is TeamPCP?

TeamPCP is a hacking group that previously claimed credit for breaching the European Commission. They reportedly stole over 90GB of data in that incident using similar supply chain attack methods.

Should I change my GitHub credentials?

GitHub hasn't indicated that user credentials were compromised. However, if you use VS Code extensions and haven't audited them recently, reviewing your installed extensions is prudent.

Source: TechCrunch / Zack Whittaker