GitHub Confirms Internal Repo Breach via Malicious VS Code Extension

On May 20, 2026, GitHub disclosed that an employee endpoint was infected through a poisoned VS Code extension. The extension acted as a trusted tool, allowing the attacker to steal credentials and access internal repositories. GitHub isolated the device, removed the malicious version, and launched its incident response.

- The threat actor’s claim of accessing roughly 3,800 repositories matches GitHub’s investigation findings. - The stolen dataset is allegedly advertised on underground forums for more than $50,000. - No public or customer-hosted repositories show evidence of exposure at this stage. - The attack used a malicious VS Code extension as the initial vector, aligning with MITRE ATT&CK technique T1195.003 (Supply Chain Compromise: Compromise Software Dependencies and Development Tools). - After gaining a foothold, the actor likely used valid cloud accounts (T1078.004) to exfiltrate data, a technique cataloged as T1041 (Exfiltration Over Command and Control Channel).

The incident shows how developer‑focused supply chain chains can bypass traditional perimeter controls. Organizations should treat IDE extensions as privileged code and enforce strict allow‑listing or signing requirements.