GitHub confirmed on Wednesday that attackers exfiltrated data from roughly 3,800 of its internal code repositories after a single employee installed a poisoned Visual Studio Code extension on a corporate device. The Microsoft-owned developer platform said it detected and contained the compromise, but the leaked repos include internal code for Copilot, CodeQL, Codespaces, Dependabot, GitHub Actions, internal infrastructure, security tooling, and marketing — effectively a tour of GitHub's own dependency graph.
How it happened
The attack vector was a malicious VS Code extension — installed locally, given trust by the IDE, and then used to harvest credentials and authentication tokens from the developer's environment. From there, the attackers pivoted into GitHub's internal organization and pulled repos at scale. The threat actor, calling itself TeamPCP, then listed the GitHub source code for sale on a cybercrime forum, asking $50,000 as a starting price.
GitHub said it has "no evidence of impact to customer information stored outside of GitHub's internal repositories." The investigation is ongoing, and rotation of internal secrets is presumably already complete.
Why VS Code extensions are now the soft underbelly
The supply-chain risk in IDE extensions has been an open secret in security research for two years. VS Code's marketplace has tens of thousands of extensions, automatic-update enabled by default, and a permissions model that grants extensions broad access to the local environment as soon as they're trusted. A poisoned extension that mimics a popular package — through typosquatting, dependency confusion, or a compromised maintainer account — is one of the cheapest ways to land a developer's machine right now.
The grim irony: GitHub is the company that owns the largest open-source supply chain in the world. They ship Dependabot, the dominant dependency-vulnerability scanner. They built CodeQL, the leading static-analysis engine. They were breached by exactly the class of attack their products are designed to detect upstream of customers. The incident will likely accelerate two things: stricter extension verification in VS Code (signed publishers, mandatory permission scopes) and more aggressive auditing of the supply chain for IDE plugins themselves.
What it means for customers
If you ship code with GitHub Actions, host on Codespaces, or run Copilot enterprise — there is no evidence of direct customer impact, but the threat surface is meaningful. The exfiltrated repos contain GitHub's internal implementation details, which gives any attacker reading them a much cleaner map of where to look for vulnerabilities in customer-facing services. The next 30 to 60 days of disclosure cadence from Microsoft and GitHub will matter more than the headline number.
The broader lesson is one the AI infrastructure cohort — covered in our Microsoft-OpenAI reset coverage last week — should already be taking seriously: the surface area of "trusted tooling" has expanded faster than the verification posture around it. VS Code extensions are this year's npm package incident, scaled to a different audience.
Source: TechCrunch, The Hacker News, GitHub statement.
Comments