GitHub Confirms Breach via Poisoned VS Code Extension
GitHub confirms hackers stole 3,800 internal code repositories after an employee installed a poisoned VS Code extension.
Key Takeaways:
- No customer data compromised.
- Breach highlights risks of supply chain attacks targeting developer tools.
- Cybercrime group TeamPCP claims responsibility.
- GitHub isolated the compromised device, removed the extension, and rotated credentials within hours.
Details of the Incident
On May 20, 2026, GitHub revealed a significant breach where a threat actor, identified as TeamPCP (also tracked as UNC6780), gained access to its internal repositories through a poisoned Visual Studio Code extension. This marked one of the largest breaches in GitHub's history.
The attacker exploited an employee's device by downloading a malicious extension from the official VS Code Marketplace. This single action granted the hacker access to thousands of private repositories, as confirmed by GitHub’s investigation.
Implications and Response:
GitHub emphasized that only internal repositories were affected and there was no evidence of impact on customer data, enterprise accounts, or user-hosted repositories. They took swift action, isolating the compromised device, removing the extension, and rotating critical credentials within hours of detection.
This incident serves as a stark reminder of the growing threat of supply chain attacks targeting developer tools. TeamPCP has a history of such attacks, compromising various security tools including Trivy, KICS, LiteLLM, TanStack, and more.
The VS Code Marketplace, while a valuable resource, poses risks due to its broad system permissions by default, making it an attractive target for attackers seeking lateral access.