Inside the Breach: How TeamPCP Poisoned a VS Code Extension to Exfiltrate 3,800 GitHub Repositories

TeamPCP, a threat syndicate, conducted a supply-chain compromise by distributing a malicious Visual Studio Code extension that harvested credentials and enabled exfiltration of approximately 3,800 internal GitHub repositories (including Copilot, Enterprise Server, red-team tooling, and XSS-hardening research). The group is attempting to sell the stolen proprietary source code rather than extorting GitHub, and GitHub has confirmed the breach, isolated affected endpoints, rotated credentials, and pledged a detailed transparency report while investigations continue to look for lingering lateral movement.