TeamPCP Breaches GitHub via Poisoned VSCode Extension, Exposing Thousands of Repos
Learn how TeamPCP used a compromised VSCode extension to breach GitHub, access ~3,800 repositories, and advertise the stolen code for sale.
TL;DR: TeamPCP used a compromised VSCode extension to infiltrate GitHub, accessing about 3,800 internal repositories and advertising the stolen code for sale.
Context
On Tuesday night GitHub disclosed a breach traced to a malicious extension for Microsoft's Visual Studio Code editor. A developer installed the poisoned plug‑in, which executed attacker‑controlled code inside the trusted environment.
The intrusion gave TeamPCP read access to repositories that hold GitHub's own source code and internal organization data. GitHub's security team detected the anomalous activity after reviewing audit logs and identified the extension as the entry point.
Key Facts
GitHub's investigation found at least 3,800 compromised repositories, all containing only the platform's own code. TeamPCP posted on BreachForums offering samples of the stolen source code and internal orgs for sale, claiming authenticity.
According to Socket, the group has run 20 attack waves in recent months, embedding malware in over 500 distinct software packages (more than 1,000 when counting versions). The activity aligns with MITRE ATT&CK technique T1195.002, which covers compromise of software dependencies and development tools.
What It Means
The incident shows how a single compromised developer tool can cascade into a wide‑scale supply‑chain breach, even when the victim's customer data remains untouched. It underscores the risk posed by trusted extensions that run with the same privileges as the host application. Organizations that rely on VSCode or similar extensible editors must treat third‑party add‑ons as potential attack vectors and review their trust models accordingly.
Mitigations
Developers should verify extension publishers and enable signature verification where available. Administrators can enforce allow‑lists for VSCode extensions via group policy or Microsoft Endpoint Configuration Manager. Monitoring for unusual outbound connections from developer workstations and reviewing installed extensions regularly helps detect rogue plug‑ins.
Applying the latest security updates for VSCode and GitHub tokens, and rotating any credentials that may have been exposed, reduces residual risk. Security teams can also create detection rules for known malicious extension IDs or for anomalous PowerShell/script execution originating from the VSCode process.
Watch for further disclosures from TeamPCP as they continue to advertise stolen code and for any signs of similar extension‑based attacks targeting other developer platforms.
Continue reading
More in this thread
TeamPCP Breach Exposes 3,800 GitHub Repositories, Source Code Offered for Sale
Peter Olaleru
Lawmakers Press CISA Over Contractor's Public GitHub Leak of AWS GovCloud Keys
Peter Olaleru
7‑Eleven breach leaks franchise applicants' SSNs, about 50 U.S. records exposed
Peter Olaleru
Conversation
Reader notes
Loading comments...