GitHub Says Poisoned VS Code Extension Led to Internal Repository Exfiltration
Summary
GitHub says a poisoned VS Code extension compromised an employee device and led to internal repository exfiltration. It removed the extension version, contained the incident and rotated critical secrets; it has no evidence customer data outside the repositories was also
Key points
- GitHub said an employee device was compromised through a poisoned Visual Studio Code extension and internal repositories were exfiltrated.
- GitHub contained the incident, removed the malicious extension version and isolated the affected endpoint.
- The company rotated critical secrets, prioritized the highest-impact credentials and is validating the rotation while monitoring for follow-on activity.
- TeamPCP’s claim that 3,800 repositories were affected was described by GitHub as directionally consistent with its investigation; GitHub has not publicly attributed the activity to a particular group.
- TeamPCP reportedly advertised the material for sale and threatened to release it if no buyer emerged.
- GitHub said it has no evidence that customer data stored outside the affected repositories was affected; a fuller report is pending.
Article Details
- Victim Organization
- GitHub
- Incident Type
- Compromise of an employee device through a poisoned Visual Studio Code extension, followed by exfiltration of GitHub-internal repositories.
- Data Types Exposed
- Internal repositories and source code
- Affected Records
- TeamPCP claimed 3,800 repositories were impacted; GitHub said the claim was directionally consistent with its investigation so far.
- Operational Impact
- GitHub detected and contained the compromise, removed the malicious extension version, isolated the affected endpoint, rotated critical secrets, and continued investigating. GitHub said it had no evidence that customer data stored outside the affected repositories was affected.
- Ransom Or Extortion
- TeamPCP reportedly advertised the material for sale on a cybercrime forum and threatened to release it if no buyer emerged.
- Claim Status
- confirmed
People
Threat Actors
Products
GitHubGitHub said internal repositories were exfiltrated after an employee device was compromised through a poisoned Visual Studio Code extension, and it has since contained the incident, removed the malicious version, andVSCodeinternal repositories were exfiltrated after an employee device was compromised through a poisoned Visual Studio Code extension, and it has since contained the incident, removed the malicious version, and rotated