GitHub has confirmed that around 3,800 internal repositories were compromised after an employee installed a malicious Visual Studio Code extension.
According to the company, the incident began when a trojanized VS Code extension, a plugin downloaded through the official VS Code Marketplace to add functionality or integrate tools into Microsoft’s code editor, infected an employee’s device. GitHub said it quickly detected and contained the breach, removed the malicious extension from the marketplace, and secured the compromised endpoint.
“Yesterday we detected and contained a compromise of an employee device involving a poisoned VS Code extension. We removed the malicious extension version, isolated the endpoint, and began incident response immediately,” GitHub said in series of posts on X.
The company added that its current investigation indicates the attackers accessed only GitHub’s internal repositories. GitHub also acknowledged that the hackers’ claim of stealing around 3,800 repositories is “directionally consistent” with findings so far.
Responsibility for the breach was claimed by the TeamPCP hacker group on the Breached cybercrime forum earlier this week. The group claimed it had obtained access to GitHub source code and roughly 4,000 private repositories, demanding at least $50,000 for the stolen data.
TeamPCP has previously been linked to large-scale supply chain attacks targeting developer ecosystems, including GitHub, PyPI, NPM, and Docker. The group was also associated with the recent Mini Shai-Hulud campaign, which reportedly affected two OpenAI employees.