GitHub has confirmed unauthorized access to approximately 3,800 internal repositories after an employee installed a malicious VS Code extension, validating claims made earlier this week by the threat actor group TeamPCP. The compromise was disclosed on May 20, 2026, with GitHub stating it has no current evidence of impact to customer-owned repositories or organizations.
What Happened
On Tuesday, the TeamPCP hacker collective posted on the Breached hacking forum claiming to possess "GitHub's source code and internal orgs," advertising roughly 4,000 private repositories for sale at a minimum asking price of $50,000. The actors framed the operation as a one-time sale rather than an extortion event, threatening to leak the data publicly if no buyer was secured.
GitHub initially confirmed it was investigating "unauthorized access to GitHub's internal repositories" and on May 20 at 04:17 EDT updated its statement to confirm the breach affected approximately 3,800 internal repositories. The root cause was traced to an employee who installed a malicious VS Code extension, granting TeamPCP a foothold into GitHub's internal development environment. The platform serves more than 4 million organizations, including 90% of the Fortune 100, and over 180 million developers.
What Was Taken
TeamPCP claims to hold roughly 4,000 repositories of private code, with GitHub confirming approximately 3,800 internal repositories were accessed. The actor stated "everything for the main platform is there" and offered to provide samples to verified buyers. GitHub has emphasized that, based on its investigation to date, there is no evidence of impact to customer-stored data, enterprise organizations, or customer repositories hosted on the platform. The exposed material is described as internal source code and supporting assets belonging to GitHub itself.
Why It Matters
A breach of GitHub's internal source code carries outsized strategic implications. Even partial exposure of platform code could surface undisclosed vulnerabilities, authentication flows, secret handling logic, or infrastructure topology that downstream attackers could weaponize against the broader GitHub ecosystem. With GitHub sitting at the center of the global software supply chain, any leaked credentials, tokens, or signing material embedded in those repositories could cascade into supply chain attacks against the 420+ million repositories the platform hosts. TeamPCP's track record makes this concern concrete rather than hypothetical.
The Attack Technique
The initial access vector was a malicious VS Code extension installed by a GitHub employee, a vector TeamPCP has repeatedly leveraged across the developer tooling ecosystem. The group has previously been linked to supply chain compromises against PyPI, NPM, Docker, and GitHub itself. In March 2026, TeamPCP compromised Aqua Security's Trivy vulnerability scanner, triggering cascading compromises that affected Aqua Security Docker images and the Checkmarx KICS project. The same campaign poisoned the LiteLLM open-source Python library, infecting tens of thousands of devices with the group's "TeamPCP Cloud Stealer" information-stealing malware. The group has also been associated with the "Mini Shai-Hulud" supply chain wave. The pattern is consistent: target developer trust surfaces, ride legitimate distribution channels, and harvest credentials and code at scale.
What Organizations Should Do
- Audit all VS Code, JetBrains, and other IDE extensions across developer workstations. Remove extensions that lack verified publishers, large install bases, or recent activity, and pin trusted extensions to specific versions.
- Enforce allowlisting for IDE extensions via enterprise MDM or endpoint management. Block side-loading and disable auto-update of extensions outside of an approved catalog.
- Rotate any tokens, deploy keys, SSH credentials, or webhook secrets that may have been shared with or referenced by GitHub internal systems, and review GitHub Actions runner configurations for anomalous access.
- Hunt for indicators associated with TeamPCP infrastructure and the TeamPCP Cloud Stealer family, particularly outbound connections from developer endpoints to known stealer C2 nodes.
- Apply least-privilege scoping to GitHub Personal Access Tokens and GitHub Apps, prefer fine-grained tokens, and enforce short expiration windows with mandatory rotation.
- Monitor for follow-on activity targeting your own GitHub organizations, including unusual OAuth app installations, new SSH keys, repository forks, or workflow changes that could indicate downstream exploitation of leaked internal knowledge.
Sources: GitHub investigates internal repositories breach claimed by TeamPCP