GitHub recently confirmed a security incident where a poisoned Visual Studio Code extension installed on an employee's workstation granted attackers access to approximately 3,800 internal repositories. The threat actor, identified as TeamPCP by Google's Threat Intelligence Group (formally UNC6780), claimed responsibility and began auctioning the stolen repositories for as little as $50,000. GitHub stated that its investigation found the attacker's claims "directionally consistent" with evidence gathered so far.
The incident unfolded as part of a broader wave of coordinated supply chain attacks targeting developer ecosystems. Security firms including Trend Micro, StepSecurity, and Snyk have documented at least seven separate campaigns linked to TeamPCP since March 2026, part of the ongoing "Mini Shai-Hulud" attack series. These attacks have consistently exploited vulnerabilities in widely used developer tools, libraries, and SDKs to propagate malicious code through legitimate software supply chains.
How the breach unfolded: a single compromised extension
GitHub disclosed the breach in a series of posts on X (formerly Twitter) on May 20, stating that an employee's device had been compromised via a malicious version of a VS Code extension. The company removed the compromised extension, isolated the affected endpoint, and initiated incident response procedures. GitHub emphasized that only internal repositories were accessed and that critical secrets were rotated immediately, with priority given to high-impact credentials.
While GitHub did not name the specific extension involved, the attack vector aligns with a recurring tactic used by TeamPCP across multiple campaigns in 2026. The threat actor has repeatedly targeted developer tools and security utilities, including Trivy, Checkmarx KICS, LiteLLM, Bitwarden CLI, and TanStack, often embedding malicious payloads in widely adopted open-source components. The compromised VS Code extension represents another instance of this pattern, where trusted development environments become vectors for supply chain compromise.
The Mini Shai-Hulud worm: forging provenance to evade detection
Parallel to the GitHub breach, security researchers uncovered a new wave of the Mini Shai-Hulud supply chain worm targeting the npm ecosystem. Endor Labs identified 42 malicious npm packages published within a 27-minute window on May 19, while broader tracking by Socket revealed a total of 639 compromised versions across 323 packages within Alibaba’s @antv data visualization suite—packages that collectively account for roughly 16 million weekly downloads.
What sets this wave apart is the attackers' use of provenance forgery. The worm now dynamically generates valid Sigstore signing certificates at runtime by interacting with Fulcio and Rekor, two widely used provenance attestation services. This allows malicious packages to display green "verified" badges in development environments, tricking developers into trusting code that has been tampered with. The build chain and attestation data belong entirely to the attacker, creating a false sense of security around compromised packages.
Broader implications: AI tools, credential theft, and rapid exploitation
The GitHub breach occurred amid a surge in attacks targeting AI-related software and developer tooling. According to Verizon’s 2026 Data Breach Investigations Report (DBIR), 67% of employees now access AI tools through non-corporate accounts, introducing additional risk vectors. Just days before the GitHub incident, Microsoft’s durabletask Python SDK on PyPI was compromised, highlighting the expanding attack surface around AI middleware and SDKs.
Cybersecurity experts warn that stolen credentials and source code from repositories like those accessed in the GitHub breach can significantly accelerate subsequent attacks. Mike Riemer, CTO of Ivanti, noted that Azure’s honeypot network now observes known vulnerabilities being exploited within 90 seconds of exposure. The combination of leaked credentials and internal infrastructure knowledge creates a dangerous multiplier effect for threat actors, shortening the reconnaissance phase of attacks and enabling faster, more targeted exploitation.
As the threat landscape evolves, organizations must prioritize supply chain security, enforce strict access controls, and implement real-time monitoring for anomalous package behavior. The convergence of AI tool adoption, developer tool compromises, and sophisticated provenance forgery represents a critical inflection point in cybersecurity—one that demands proactive defense strategies and heightened vigilance across the software supply chain.
AI summary
GitHub, bir çalışanın cihazına yüklenen zehirli bir VS Code uzantısı nedeniyle yaklaşık 3.800 dahili repoyu kaybettiğini doğruladı. Tehdit grubu TeamPCP, bu repoları satışa çıkardı.
