GitHub Says Malicious VS Code Extension Led to Theft of About 3,800 Internal Repositories
Summary
GitHub says an attack using a malicious Visual Studio Code extension led to theft of about 3,800 internal repositories. It removed the extension, isolated affected endpoints and rotated security keys; log analysis continues.
Key points
- GitHub said it detected and contained an attack targeting an employee device on May 19.
- The attack used a malicious Visual Studio Code extension, whose affected version GitHub removed.
- GitHub's current assessment says internal repositories were stolen; the roughly 3,800-repository figure claimed by the attacker matches its findings.
- GitHub isolated affected endpoints and rotated important security keys, prioritizing the most affected credentials.
- The company said it will continue log analysis, validate the key rotations and monitor for suspicious activity before publishing a final investigation report.
Article Details
- Victim Organization
- GitHub
- Incident Type
- Unauthorized access to and theft of internal repositories using a malicious Visual Studio Code extension.
- Data Types Exposed
- Internal repositories
- Affected Records
- Approximately 3,800 repositories; the reported number of stolen repositories was consistent with GitHub's investigation.
- Operational Impact
- GitHub detected and contained an attack targeting an employee's device, removed the malicious extension version, isolated affected endpoints, and rotated important security keys. Investigation and monitoring continued.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed