Summary
GitHub has confirmed a significant breach of its internal infrastructure after threat actor group TeamPCP listed approximately 3,800 of the platform’s internal repositories for sale on a cybercrime forum for $50,000. The Microsoft-owned company disclosed that the compromise originated from a poisoned Visual Studio Code extension installed on an employee’s device, which gave attackers access to internal systems.
GitHub has stated that customer-facing repositories, organizations, and enterprise data appear unaffected — the exfiltration was limited to GitHub’s own internal repositories. The company has rotated critical secrets and is prioritizing remediation of highest-impact credentials. TeamPCP, known for a string of software supply chain attacks, posted on X that this was “not a ransom” and threatened to leak the data for free if no buyer is found.
The incident is particularly concerning because TeamPCP’s self-replicating malware campaign, dubbed “Mini Shai-Hulud,” continues to expand. The group also recently compromised the durabletask PyPI package — an official Microsoft Python client — using credentials harvested from a prior GitHub account compromise.
Source
The Hacker News · SecurityWeek
Commentary
This breach underscores the growing threat of supply chain attacks targeting developer tooling. A poisoned VS Code extension — something millions of developers install without a second thought — was enough to compromise one of the most critical platforms in the software development ecosystem. The irony of GitHub itself falling victim to a supply chain attack through its parent company’s own IDE is not lost on the security community.
TeamPCP’s escalating campaign, from PyPI package compromises to GitHub’s internal repos, demonstrates a methodical adversary that understands how to chain access across the software supply chain. Organizations should audit their IDE extensions, enforce extension allowlists, and treat developer workstations as high-value targets rather than afterthoughts in their security architecture.