Massive GitHub Security Breach: 3,800 Internal Repositories Stolen Via Malicious VS Code Extension

A major cybersecurity incident has shaken the software development world as GitHub confirmed a breach involving the exfiltration of 3,800 of its internal repositories. The attack was traced to a poisoned Visual Studio Code (VS Code) extension, highlighting anew the urgent dangers lurking in software supply chains and developer tooling.

Key Takeaways

• Attackers compromised a GitHub employee's device using a malicious VS Code extension.

• 3,800 internal GitHub repositories were stolen; no public or customer repositories confirmed impacted.

• The notorious TeamPCP group has claimed responsibility and is offering the stolen data for sale.

• The extension was distributed for just 18 minutes, but the impact was immediate and severe.

• The attack demonstrates evolving threats facing developer ecosystems and the software supply chain.

How the Attack Unfolded

On May 18, 2026, attackers managed to publish a backdoored version of the popular Nx Console VS Code extension—an essential tool with over 2 million installs. A GitHub employee’s device, with auto-update enabled, installed this malicious upgrade. The extension, which looked and behaved as usual, silently executed commands to download further payloads and harvest sensitive credentials before spreading them to the attackers.

The infected build was online for only 18 minutes on the Visual Studio Marketplace, yet it was enough to compromise systems belonging to high-profile organizations. GitHub’s security team swiftly responded by removing the extension, isolating the affected endpoint, and initiating an emergency incident response.

The Supply Chain Ripple Effect

This wasn’t an isolated event. The breach coincided with several supply chain compromises—affecting npm packages, popular Python SDKs, and other developer tools—within a staggering 48-hour window. Investigations revealed a pattern: attackers are increasingly exploiting trusted developer tooling, weaponizing features like auto-updates that routinely push new code to millions of machines.

The incident underscores a core problem with current extension and package marketplaces: automatic updates deliver both improvements and, in cases of compromise, malicious payloads directly into trusted environments with minimal oversight.

Who Was Impacted—and What’s Next

GitHub reported no evidence that public or customer repositories were affected. However, some internal repositories contained derived customer information, such as excerpts from support tickets. Customers will be notified if investigations reveal their data was touched. Critical secrets were rotated and logs are under review to ensure no further unauthorized access remains.

The attacker group behind the breach, known as TeamPCP, has been linked to a series of high-profile supply chain attacks throughout the year. They are selling access to the stolen data for $50,000 and threatening to leak it if not purchased.

Lessons and Security Improvements

This breach has sparked renewed calls for fundamental changes in how software supply chains are protected, especially around:

• Reviewing and controlling VS Code extension auto-update policies.

• Pinning known-good versions of extensions and avoiding immediate automatic installations.

• Implementing organizational controls to approve extension updates only after a security review window.

Security professionals also recommend all developers rotate credentials and audit their devices if the malicious Nx Console extension was ever installed during the exposure period.

Looking Forward

GitHub’s breach serves as a dramatic warning: Supply chain and developer tooling attacks are becoming more frequent, more targeted, and more destructive. Enterprises must urgently reassess policies around auto-updating extensions, credential hygiene, and end-to-end visibility across their internal software tooling.

The wider developer community, along with marketplace operators, will likely face increasing pressure to strengthen update policies, introduce mandatory review windows, and provide real-time notifications to users when compromise is detected. As attackers evolve their tactics, so must the defenses that underpin the world’s critical code infrastructure.

References

• GitHub Internal Repositories Breached via Malicious Nx Console VS Code Extension, The Hacker News.

• GitHub internal repositories exfiltrated via malicious VS Code extension, IT Pro.

• The Wild West of VS Code extensions and how a poisoned extension breached GitHub, Aikido Security.

• GitHub Internal Repositories Breached Via Weaponized VS Code Extension, CyberSecurityNews.

• GitHub confirms 3,800 internal repos stolen through poisoned VS Code extension as supply chain worm hitsMicrosoft’s Python SDK, VentureBeat.