← Back to feed

GitHub confirmed on May 20 that an employee device was compromised via a poisoned third-party Visual Studio Code extension, resulting in the exfiltration of approximately 3,800 internal code repositories. The attack was detected and contained on May 18. TeamPCP, a financially motivated supply chain group tracked by Google Threat Intelligence as UNC6780, has claimed responsibility.

GitHub’s statement: “Our current assessment is that the activity involved exfiltration of GitHub-internal repositories only. The attacker’s current claims of ~3,800 repositories are directionally consistent with our investigation so far.” No evidence of impact to customer repositories, enterprises, or organizations was found.

Entry Point: VS Code Extensions

A single poisoned editor extension gave the attacker code execution on a developer machine with access to GitHub’s internal infrastructure. The extension name has not been disclosed.

VS Code extensions run with full user-level access. They can read credential stores, SSH keys, cloud CLI profiles, package registry tokens, and local repository clones — everything a developer endpoint accumulates over time. GitHub removed the malicious extension version, isolated the endpoint, and began rotating high-impact credentials Monday night, prioritizing by blast radius.

TeamPCP is now listing the stolen source code on the Breached cybercrime forum with a minimum asking price of $50,000, describing it as a direct sale rather than a ransomware scheme: one buyer takes the archive, data gets shredded. If no buyer materializes, the group has threatened to leak repository names and files publicly.

Fifth Major Breach in 2026 for TeamPCP

This is the fifth prominent target TeamPCP has compromised this year. Earlier victims include Checkmarx, Bitwarden CLI, TanStack, and several open-source packages with hundreds of millions of combined weekly downloads. The group’s Mini Shai-Hulud worm propagates through poisoned npm and PyPI packages, stealing CI/CD credentials and cloud access keys, then self-replicating by publishing infected versions of other packages using stolen registry access.

The May 11 wave of Mini Shai-Hulud hit over 170 packages, including TanStack and the official Microsoft Python Durable Task client, in under six hours. The GitHub breach followed nine days later.

The attack pattern is consistent across campaigns: compromise developer tooling, harvest authenticated sessions and tokens, exfiltrate what the identity can reach. No exploitation of GitHub.com itself was required. The employee’s device already had access to the internal repositories.

What Internal Source Code Exposes

GitHub serves over 180 million developers and 4 million organizations. Internal source code repositories are not customer data, but they contain the authentication layers, internal API surfaces, and deployment infrastructure that underpin those 180 million accounts. Analysts have documented cases where access to platform source code enabled targeted exploitation months after the original incident closed.

GitHub says some internal repositories may contain customer-related material — excerpts of support interactions, for example. The company has said it will notify customers through established incident response channels if any impact is discovered.

An X account linked to TeamPCP, xploitrsturtle2, taunted GitHub publicly: “GitHub knew for hours, they delayed telling you and they won’t be honest in the future.”

The fuller incident report, including the extension name and full scope of the exfiltrated material, has not yet been published. GitHub says it is forthcoming.