GitHub: Employee Faces Malicious VS Code Extension Attack, Around 3,800 Internal Repositories Stolen

On May 20, GitHub shared details from its investigation into an unauthorized access breach targeting its internal repositories. The company’s announcement noted that it detected and contained an attack on an employee’s device the prior day, which exploited a malicious Visual Studio Code (VS Code) plugin. Since then, GitHub has removed the malicious plugin version, isolated the affected endpoints, and launched a timely incident response. Current assessments confirm this incident only involved the theft of GitHub’s internal repositories. The attacker’s claim of approximately 3,800 repositories aligns with GitHub’s investigation findings to date. To mitigate risks swiftly, GitHub rotated critical security keys starting yesterday and through the night, prioritizing the most impacted credentials. Moving forward, GitHub will continue analyzing system logs, validating completed key rotations, and monitoring for any additional suspicious activity. A full, comprehensive investigation report will be released once the probe is finalized.