What Happened: GitHub Confirms the Breach

On May 19, 2026, GitHub confirmed that hackers had breached its internal systems and stolen approximately 3,800 internal repositories. The attack, attributed to the infamous threat group TeamPCP, was executed through a surprisingly simple vector: a poisoned Visual Studio Code extension installed on a single GitHub employee's development machine.

GitHub announced the breach via X (formerly Twitter), stating: "Our current assessment is that the activity involved exfiltration of GitHub-internal repositories only. The attacker's current claims of ~3,800 repositories are directionally consistent with our investigation so far." The company immediately rotated critical secrets, prioritized the highest-impact credentials, and isolated affected endpoints.

The threat actor TeamPCP listed the stolen data on BreachForums with a minimum price of $50,000, later relisting it on the Lapsus$ data leak site for $95,000 according to dark web researcher Matthew Maynard. The message from TeamPCP was blunt: "This is not a ransom. We do not care about extorting GitHub. One buyer and we shred the data on our end."

While GitHub stated that no customer data was compromised, the breach represents a seismic event in the software supply chain security landscape. If GitHub itself can fall victim to a poisoned IDE extension, no organization is safe.

The Attack Vector: A Poisoned VS Code Extension

Security researchers quickly identified the compromised extension as Nx Console (nrwl.angular-console, version 18.95.0), published on May 18, 2026. The malicious version was live for just 18 minutes before being taken down, but that was enough time for it to reach at least one GitHub employee's development environment.

Sophos X-Ops, which published a detailed analysis of the attack, recovered the malware responsible: a Python backdoor named cat.py installed at /Users/%/.local/share/kitty/cat.py. The backdoor is particularly sophisticated in its command-and-control approach:

• It uses GitHub's own Search API as a covert communication channel
• It polls api.github.com/search/commits every hour for the keyword firedalazer
• It extracts commands from commit messages, verifies them against a built-in RSA public key, and downloads and executes arbitrary payloads

This is the same malware family used in the recent TanStack supply chain compromise — a campaign that also hit OpenAI, Mistral AI, and UiPath.

The attack exploited a fundamental trust model problem: VS Code extensions run with the same privileges as the editor itself. Once installed, an extension has full access to the developer's filesystem, credentials, SSH keys, cloud tokens, environment variables, and any internal systems the developer can reach. There is no meaningful pre-execution verification before extension code runs.

As Charlie Eriksen, a security researcher at Aikido Security, noted: "VS Code extensions have full access to all data on a developer's machine, including credentials, SSH keys, cloud keys, and all other secrets."

Who Is TeamPCP? A Supply Chain Terror

TeamPCP has become one of the most dangerous threat actors targeting the open source ecosystem in 2026. Their modus operandi is consistent: poison trusted developer tools and ride the trust chain into high-value targets.

TeamPCP's Known Campaigns in 2026

Target	Month	Impact
Trivy (vulnerability scanner)	March	Led to 92 GB European Commission breach via cloud credential theft
Checkmarx	April	Supply chain compromise through developer tooling
Bitwarden CLI	April	Credential harvesting from developer environments
TanStack npm packages	May	84 malicious packages; OpenAI, Mistral AI, UiPath affected
GitHub	May	3,800 internal repos stolen via poisoned Nx Console extension

The group also created the Shai-Hulud self-replicating worm (named after the sandworms from Dune), which targets JavaScript and Python repositories. They recently published the worm's source code on GitHub itself, taunting the platform's security teams.

Mackenzie Jackson of Aikido Security summed up the severity: "Developer workstations are the number one target in supply chain attacks right now, and this is exactly why. TeamPCP has compromised Trivy, Checkmarx, Bitwarden CLI, TanStack, and now GitHub, all in 2026, all through developer tooling."

Why This Matters for Your Password Security

You might be thinking: "I'm not a developer. Why should I care about a GitHub breach?" The answer is that this attack has cascading implications for anyone who uses software — which is everyone.

First, the supply chain angle. GitHub hosts millions of open source projects that power the tools and services we use every day. If someone gains access to GitHub's internal repositories, they could potentially find ways to inject backdoors into widely-used code before it reaches users. The same poisoned developer tooling technique that hit GitHub could easily be turned against any software vendor your organization relies on.

Second, stolen credentials. TeamPCP specializes in harvesting credentials from developer environments. The SSH keys, API tokens, and cloud secrets stolen in this breach could be used for months or years to come. While GitHub says customer data wasn't affected, the cascading effects of compromised internal credentials can take time to materialize.

Third, the attack vector is universal. If you use VS Code — and millions of developers do — you are trusting extensions with full access to your machine. The same mechanism that gave TeamPCP access to GitHub's internal systems could be used against any organization, including the companies that store your personal data.

How to Protect Yourself After the GitHub Breach

While you cannot undo GitHub's breach, you can take immediate steps to protect your own credentials and accounts:

1. Audit Your VS Code Extensions

If you or your team use VS Code, review every installed extension. Check the publisher reputation, when it was last updated, and what permissions it requires. Remove any extensions you do not actively use. Pay special attention to extensions with broad permission scopes, particularly those enabling shell execution or network access.

2. Rotate Developer Credentials

If you have any accounts linked to GitHub — and most developers do — consider rotating personal access tokens, SSH keys, and OAuth tokens. Use short-lived tokens where possible and enforce SSO for team accounts.

3. Enable Multi-Factor Authentication Everywhere

MFA remains the single most effective defense against credential theft. Even if your password or token is stolen, a second authentication factor can block account takeover. For detailed setup instructions, see our complete MFA setup guide.

4. Use a Password Manager

A password manager generates and stores unique, complex passwords for every account. When a breach like this exposes credentials, having unique passwords means only the affected service is compromised — not every account you own. See our 2026 password manager review for our top recommendations.

5. Monitor for Credential Stuffing Attacks

Stolen credentials from any breach are frequently used in credential stuffing attacks — where attackers test stolen username-password combinations across hundreds of other services. If you reuse passwords, every breach puts all your accounts at risk. Learn more in our guide to credential stuffing and how to prevent it.

6. Check Your Accounts on Have I Been Pwned

Visit Have I Been Pwned and enter your email address to check whether your credentials have appeared in any known breaches. If they have, change those passwords immediately.

The Bigger Picture: Supply Chain Attacks Are the New Normal

The GitHub breach is not an isolated incident. It is part of a broader trend where attackers target the software development supply chain — the tools, libraries, and platforms developers trust to build software.

In just the past few weeks, we have covered the OpenAI TanStack supply chain attack, where 84 malicious npm packages stole credentials from employee devices, and the Microsoft Edge plaintext password vulnerability, where saved passwords were found to be decryptable in RAM at all times. These stories share a common thread: the tools we trust to store and manage our credentials are increasingly the targets themselves.

Ransomware and extortion groups are no longer content with encrypting files — they are after credentials, access tokens, and the keys to the kingdom. AI-powered phishing attacks have surged 1,265% this year, and threat actors like TeamPCP are using AI to automate the discovery of vulnerable extensions and packages at a scale humans could not achieve.

Analysis: Why Developer Tools Are the Perfect Target

Roy Akerman of Silverfort offered a sobering perspective on the GitHub breach: "A VS Code extension runs with the same privileges as the editor itself, and once installed it has access to everything the developer can reach. There is no meaningful verification before that code executes. What makes this breach remarkable is not the entry point, it is that TeamPCP used GitHub's own infrastructure as the weapon end to end."

Kayne McGladrey of IEEE echoed this: "VS Code extensions run with full trust, which means that they get access to the developer's filesystem, credentials, cloud keys, SSH keys, and environment variables."

Most security teams still have minimal visibility into what extensions or packages are installed on their developers' machines, or how recently those extensions were published. That blind spot is precisely what attackers like TeamPCP keep exploiting.

FAQs: GitHub VS Code Extension Breach

What happened in the GitHub breach? GitHub confirmed that on May 19, 2026, threat actor TeamPCP stole approximately 3,800 internal repositories after a GitHub employee installed a poisoned VS Code extension (Nx Console version 18.95.0). The stolen data was listed for sale on underground forums for $50,000 to $95,000.

Was my GitHub account or data affected? GitHub stated that only internal GitHub repositories were exfiltrated. Customer repositories, user accounts, and enterprise data were not affected. However, if you reuse passwords across services, your credentials could be at risk from credential stuffing attacks using data from this or related breaches.

What is TeamPCP? TeamPCP is a financially motivated threat group specializing in software supply chain attacks. In 2026 alone, they have compromised Trivy, Checkmarx, Bitwarden CLI, TanStack (affecting OpenAI, Mistral AI, and UiPath), and now GitHub. They are also responsible for the Shai-Hulud self-replicating worm.

How can I check if my credentials were stolen? Use Have I Been Pwned to check if your email address or credentials appear in known breach data. You can also use our password generator to create strong, unique passwords for every account.

Should I stop using VS Code extensions? You do not need to stop using VS Code entirely, but you should audit your installed extensions regularly. Remove unused extensions, check publisher reputation, and be cautious about extensions that request broad permissions. Organizations should implement extension approval policies and monitor for anomalous extension behavior.

What should I do right now to protect myself? Rotate any credentials that might be linked to GitHub or developer tooling, enable multi-factor authentication on every account that supports it, use a password manager to generate unique passwords, and monitor your accounts for unusual activity. Start with our guide to creating strong passwords.

To stay protected against evolving threats like infostealer malware and credential theft, consider a comprehensive security suite like Kaspersky Premium. It includes advanced malware protection, password monitoring, and breach alerts that help you detect compromised credentials early.