GitHub Confirms 3,800 Internal Repositories Exfiltrated in TeamPCP-Linked VS Code Extension Breach

Summary

GitHub confirmed about 3,800 internal repositories were exfiltrated after a compromised VS Code extension harvested credentials. The company removed the extension, isolated an endpoint, rotated keys and tokens, and is preparing a technical report.

Key points

GitHub confirmed that approximately 3,800 internal repositories were exfiltrated.
The article says the stolen repositories included code for GitHub Copilot, GitHub Enterprise Server, and internal security systems.
A compromised Visual Studio Code extension reportedly harvested engineers' active authentication credentials.
Forensics reportedly linked the extension compromise to a TeamPCP-orchestrated supply-chain worm that hijacked the extension developer's publishing infrastructure.
GitHub removed the malicious extension, isolated an affected employee endpoint, and began rotating potentially exposed keys and access tokens.
GitHub is reviewing historical logs for possible lateral movement or further credential harvesting and plans to publish a technical transparency report.
TeamPCP claims to be selling the stolen source code and internal data; the sale claim is not independent evidence beyond the reported breach.

Article Details

Victim Organization: GitHub
Victim Domain: github.com
Incident Type: Supply-chain compromise involving a malicious Visual Studio Code extension that harvested authentication credentials and enabled exfiltration of GitHub internal source-code repositories.
Data Types Exposed: Internal source code
Active authentication credentials
Internal organizational data
Affected Records: Approximately 3,800 internal repositories were exfiltrated.
Operational Impact: GitHub removed the malicious extension variant, isolated the affected employee endpoint, and rotated potentially exposed keys and access tokens. The article reports no service disruption.
Ransom Or Extortion: TeamPCP reportedly offered the stolen source code and internal data for sale, describing it as a direct commercial sale rather than an extortion scheme. No ransom demand is reported.
Claim Status: confirmed

Threat Actors

TeamPCPGitHub's breach was linked to a supply-chain worm campaign attributed to TeamPCP; the article says the compromised extension developer's administrative infrastructure was hijacked to publish a weaponized extension. GitHub confirmed the repository exfiltration, while the article characterizes TeamPCP's role in the campaign as linked or attributed rather than independently confirmed.

Vendors

GitHubTeamPCP claims to be directly selling stolen GitHub source code and internal data, while GitHub has confirmed that about 3,800 internal repositories were exfiltrated.

Products

GitHub CopilotCode extension used in a supply-chain worm campaign that harvested credentials and exposed code for GitHub Copilot, GitHub Enterprise Server, and other internal systems.GitHub Enterprise Serverin a supply-chain worm campaign that harvested credentials and exposed code for GitHub Copilot, GitHub Enterprise Server, and other internal systems.VSCodeThe breach is linked to a compromised Visual Studio Code extension used in a supply-chain worm campaign that harvested credentials and exposed code for GitHub Copilot, GitHub Enterprise Server, and other internal