GitHub Internal Repositories Exfiltrated via Poisoned VS Code Extension

GitHub confirmed that an attacker accessed internal repositories after a malicious Visual Studio Code extension was installed on an employee device, leading to the exfiltration of roughly 3,800 GitHub-internal repositories. GitHub said it detected and contained the intrusion, removed the malicious extension version, and isolated the affected endpoint. Independent analysis of a leaked file list reportedly found 3,874 unique .tar.gz archive names, broadly matching GitHub’s estimate of the stolen data.

The exposed repositories reportedly include projects tied to security tooling, identity systems, CI/CD, infrastructure-as-code, GitHub Actions, Terraform, certificates, and Copilot-related work, increasing the risk of follow-on supply-chain abuse and targeted social engineering. The threat actor, using the alias TeamPCP, is said to be offering the dataset for sale on an underground forum for more than $50,000, raising concerns that internal code and operational details could be weaponized against GitHub and its customers.