GitHub Hacked – Internal Source Code Repositories Compromised via Employee Device

GitHub confirmed unauthorized access to internal repositories after a poisoned Visual Studio Code extension compromised an employee device; the attacker exfiltrated data from internal/private repositories (GitHub estimates align with claims of ~3,800–4,000 repos) and a criminal group calling itself TeamPCP is offering the dataset for sale. GitHub removed the malicious extension, isolated the affected endpoint, rotated critical secrets, and is conducting continuous log analysis while investigating further exposure and remediation.