Story perspectives

GitHub Removes Malicious VS Code Extension After 3,800 Repo Breach

5/21/2026

Summary

GitHub Extension Theft

GitHub confirmed a malicious VS Code extension stole data from about 3,800 internal repositories.
GitHub isolated the compromised device, removed the extension, and rotated the exposed secrets.
TeamPCP posted the stolen code on a forum and demanded $50,000.
Researchers tied the extension to a brief Nx Console release that harvested credentials for GitHub, AWS, npm and other services.
GitHub reported no evidence that customer data outside the internal repositories was affected.

Summary

TeamPCP Supply-Chain Attack

TeamPCP has executed 20 waves of supply-chain attacks that compromised more than 500 open-source projects.
The breaches affect over a thousand code versions and have exposed hundreds of downstream firms.
Victims include AI leader OpenAI and data-contracting company Mercor, showing the attacks reach beyond GitHub.
TeamPCP markets stolen code on BreachForums and repeatedly injects malware into popular developer tools such as VSCode extensions and AntV.

History

Historical Context

The 2017 WannaCry ransomware infected more than 230,000 computers in over 150 countries, revealing global software fragility. In 2021 the Log4j “Log4Shell” flaw compromised hundreds of millions of devices, highlighting supply-chain risks. Around the same time, Microsoft suffered DNS-based attacks, illustrating the expanding threat landscape for open-source and enterprise software.

1 of 3

GitHub Extension Theft

GitHub confirmed a malicious VS Code extension stole data from about 3,800 internal repositories.
GitHub isolated the compromised device, removed the extension, and rotated the exposed secrets.
TeamPCP posted the stolen code on a forum and demanded $50,000.
Researchers tied the extension to a brief Nx Console release that harvested credentials for GitHub, AWS, npm and other services.
GitHub reported no evidence that customer data outside the internal repositories was affected.

1 / 3