GitHub Investigates Internal Repository Access After Employee Device Compromise
Summary
GitHub is investigating access to internal repositories after confirming an employee-device compromise tied to a poisoned VS Code extension; TeamPCP claims about 3,800 repositories. The article also details malicious durabletask PyPI releases in the Mini Shai-Hulud camp
Key points
- GitHub is investigating unauthorized access to internal repositories. It said its current assessment involved exfiltration of internal repositories and that it had no evidence of impact to customer information stored outside them.
- GitHub confirmed it contained a compromise involving an employee device and a poisoned Visual Studio Code extension. It rotated critical secrets, prioritizing the highest-impact credentials.
- TeamPCP offered GitHub source code and internal organizations for sale, claiming about 4,000 repositories; GitHub said the actor’s claim of about 3,800 was directionally consistent with its investigation. The group described the offer as a sale, not extortion.
- Three malicious durabletask PyPI versions were identified: 1.4.1, 1.4.2, and 1.4.3. The package is described as an official Microsoft Python client for the Durable Task framework.
- The package’s dropper fetches a second-stage payload from check.git-service[.]com. The Linux-only infostealer targets cloud, password-manager, and developer credentials, as well as SSH keys and other secrets.
- The worm can spread from AWS environments to EC2 instances through SSM and from Kubernetes environments using kubectl exec. It can search GitHub commit messages for FIRESCALE data to locate backup command-and-control infrastructure.
- The article says machines or pipelines that installed an affected package version should be treated as fully compromised; GitHub said it would notify customers if it discovers an impact.
Article Details
- Victim Organization
- GitHub
- Victim Domain
- github.com
- Incident Type
- Unauthorized access to GitHub internal repositories following a confirmed employee-device compromise involving a poisoned Visual Studio Code extension; GitHub assessed that internal repositories were exfiltrated.
- Data Types Exposed
- GitHub internal repository data
- Source code
- Affected Records
- Approximately 3,800 repositories, directionally consistent with GitHub's investigation; TeamPCP claimed about 4,000.
- Affected Data Size
- Not disclosed
- Operational Impact
- GitHub confirmed it contained a compromised employee device and rotated critical secrets, prioritizing the highest-impact credentials. GitHub said it had no evidence of impact to customer information stored outside its internal repositories and was monitoring for follow-on activity.
- Ransom Or Extortion
- TeamPCP said the listing was not a ransom demand, offered the alleged data for at least $50,000, and threatened to leak it for free if no buyer was found. These were the group's claims.
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | check[.]git-service[.]com | Reported attacker-controlled server used to deliver the second-stage payload. |
| DOMAIN | t[.]m-kosche[.]com | Reported secondary command-and-control domain used as a fallback to download the payload. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe infostealer exfiltrates harvested data to an attacker-controlled domain.T1059.004 · Unix ShellThe payload uses shell execution, including running a command to delete files under specified system-setting conditions.T1105 · Ingress Tool TransferThe package dropper fetches the second-stage payload from an external server.T1555.005 · Password ManagersThe stealer attempts to unlock and dump 1Password and Bitwarden password vaults.
People
Threat Actors
Malware
Vendors
Products
1Passwordto SafeDep, the 28KB Python stealer also attempts to read HashiCorp Vault KV secrets, unlock and dump 1Password and Bitwarden password vaults, and access SSH keys, Docker credentials, VPN configurations, and shellAWSThe malicious package steals credentials and can spread across AWS and Kubernetes environments.Bitwardenthe 28KB Python stealer also attempts to read HashiCorp Vault KV secrets, unlock and dump 1Password and Bitwarden password vaults, and access SSH keys, Docker credentials, VPN configurations, and shell history.DockerHashiCorp Vault KV secrets, unlock and dump 1Password and Bitwarden password vaults, and access SSH keys, Docker credentials, VPN configurations, and shell history.DurableTaskThe same threat actor is expanding the Mini Shai-Hulud campaign through the compromised durabletask PyPI package, which delivers a Linux-focused infostealer and worm-like propagation across cloud and developerGitHubGitHub said it is investigating unauthorized access to its internal repositories after TeamPCP listed its source code and internal organizations for sale, while also confirming a compromised employee device tied to aHashiCorp VaultAccording to SafeDep, the 28KB Python stealer also attempts to read HashiCorp Vault KV secrets, unlock and dump 1Password and Bitwarden password vaults, and access SSH keys, Docker credentials, VPN configurations, andKubernetesThe malicious package steals credentials and can spread across AWS and Kubernetes environments.PyPIThe same threat actor is expanding the Mini Shai-Hulud campaign through the compromised durabletask PyPI package, which delivers a Linux-focused infostealer and worm-like propagation across cloud and developerVSCodeorganizations for sale, while also confirming a compromised employee device tied to a poisoned Visual Studio Code extension.