GitHub confirmed a breach affecting thousands of its internal repositories, attributed to a compromised device of an employee via a malicious Visual Studio Code extension. The company detected the breach and contained it on the previous day, taking steps to remove the harmful extension from the VS Code Marketplace and isolating the affected device.
The hacker group TeamPCP claimed responsibility for accessing nearly 4,000 private repositories and stated they exfiltrated internal source code and sensitive data, seeking at least $50,000 from potential buyers for the stolen information. They clarified that this transaction was not a ransom demand but a sale, threatening to make the repositories public if no buyer is found.
GitHub's investigation revealed that the attackers' claims about accessing approximately 3,800 repositories align with initial findings. As a precaution, the company has rotated critical credentials and is actively monitoring for further malicious activity. TeamPCP has a history of involvement in significant cyber campaigns targeting platforms like GitHub and PyPI, highlighting the ongoing risk posed by malicious VS Code extensions in the developer ecosystem.