GitHub Internal Repositories Breached via Malicious Extension | MSSP Advisory

GitHub confirmed attackers exfiltrated code from approximately 3,800 internal repositories through a compromised employee device infected with a malicious Visual Studio Code extension. The TeamPCP threat group claims responsibility and is attempting to sell the stolen source code for at least $50,000.

Your own development team likely uses VS Code extensions daily, making your internal repositories and client code equally vulnerable to the same supply chain attack vector. Every client you advise about secure development practices now needs immediate guidance on extension vetting since GitHub itself fell victim to this attack method.

📬