GitHub Investigates Internal Repo Breach After Malicious VS Code Extension Attack

GitHub has confirmed it is investigating unauthorized access to its internal repositories after a security incident tied to a compromised VS Code extension.

In an initial update posted on X on May 20, the company said it had detected suspicious access to internal systems. GitHub stressed that there was no evidence at the time that customer data stored outside internal repositories had been affected. However, it added that it was actively monitoring for any follow-on activity.

 

Source: GitHub

Later the same day, GitHub shared a more detailed breakdown of what happened. According to the company, the incident began with a compromised employee device that had been infected through a poisoned Visual Studio Code extension. The extension was later removed, and the affected device was isolated as part of the response.

 

Source: GitHub

GitHub said the attacker appears to have exfiltrated internal repositories only. It also noted that claims circulating online about roughly 3,800 repositories being accessed are “directionally consistent” with its ongoing investigation.

As part of its response, GitHub confirmed that critical credentials were rotated quickly, with priority given to the most sensitive systems. The company also said it is continuing to review logs, validate security changes, and monitor for any further suspicious activity. A full report is expected once the investigation is complete.

Supply Chain Concerns Spread Across The Developer Community

The incident quickly gained attention across crypto and developer circles, where concerns about supply chain security began to grow.

Web3 entrepreneur Justin Wu reacted on X, warning that a breach of this scale could expose entire startup backends if internal systems and repositories were compromised. He pointed to source code, API keys, and internal tools as especially sensitive assets in such scenarios.

Meanwhile, Binance founder CZ also weighed in, urging developers to review and rotate any API keys that may be stored in code, including private repositories.

 

Source: CZ Binance

Cybersecurity commentary platform CoinBureau also reported that a threat group calling itself TeamPCP had claimed responsibility for the attack. The group allegedly stated it had accessed around 4,000 private repositories and was attempting to sell the data for more than $50,000 on underground forums. GitHub has not confirmed these claims but continues to investigate the scope of the breach.

The incident was further amplified by posts across X describing how the attack may have originated from a poisoned VS Code extension that briefly passed through the official marketplace. According to these reports, the malicious update was live for only a short time before being removed, but it may have already reached developers with auto-update enabled.

Some security commentators described the incident as a classic supply chain attack, where trusted developer tools become the entry point for wider system access. If confirmed, it would highlight how quickly a single compromised extension can scale across millions of machines.

What This Means For Developers?

GitHub has said no customer repositories or external organizations have been confirmed as impacted so far. Still, it has urged continued caution as the investigation continues.

As the situation develops, developers are being advised to rotate sensitive credentials, review connected API keys, and monitor any tools or extensions that may have access to internal systems.

The full scope of the incident remains unclear. However, the breach has already reignited concerns around developer tool security and how dependent modern software ecosystems are on shared infrastructure.