Reported by 1 outlet
GitHub Confirms 3,800 Internal Repos Breached via Malicious VS Code Extension — TeamPCP Claims Responsibility
Why this score
- Breadth
- 0.50 / 2.0 · 1 source
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.80 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
GitHub Confirms 3,800 Internal Repos Breached via Malicious VS Code Extension — TeamPCP Claims Responsibility
bleepingcomputer.com · 147d ago · May 20th, 2026
GitHub has confirmed that approximately 3,800 internal repositories were breached after an employee installed a trojanized VS Code extension. The attack was detected and contained by GitHub's security team, who removed the unnamed malicious extension from the marketplace and isolated the compromised endpoint. The TeamPCP hacker group is claiming responsibility and advertising the stolen data (reported as "~4,000 repos of private code") on the Breached cybercrime forum with a minimum asking price of $50,000. The company's assessment confirms the attacker's claims of ~3,800 repositories are "directionally consistent." No customer data from outside the affected repos is believed to have been compromised. TeamPCP is the same group behind the ongoing Mini Shai-Hulud supply chain campaign that previously impacted two OpenAI employees via compromised TanStack packages. Last year, malicious VS Code extensions with 9 million installs were pulled for security risks, and in January, two AI-based coding assistant extensions with 1.5 million installs exfiltrated data from developer systems.