What happened
In May 2026, GitHub confirmed it had been breached. On May 19, the criminal group TeamPCP announced on a leak forum (Breached) that it was selling GitHub's internal source code and organization data, around "~4,000 repos of private code," with a minimum bid of $50,000. The group threatened to leak everything for free if no buyer appeared.
That same day, GitHub said it was investigating unauthorized access to its internal repositories. On May 20, it confirmed the incident in posts on its official X account:
"Our current assessment is that the activity involved exfiltration of GitHub-internal repositories only. The attacker's current claims of ~3,800 repositories are directionally consistent with our investigation so far."
How the attackers got in
The entry point was the computer of a GitHub employee who installed a poisoned VS Code extension. On May 21, the extension was revealed to be Nx Console, a legitimate and popular tool. A malicious version (18.95.0, tracked as CVE-2026-48027) was live on the Visual Studio Marketplace for about 18 minutes. That was enough.
According to Nx Console's own security advisory, a project developer's account had already been compromised in another supply-chain attack, the TanStack incident, part of the "Mini Shai-Hulud" campaign. With the stolen credentials, the attackers ran workflows in the Nx Console repository and published the tampered version.
GitHub's response
- removed the malicious extension version and isolated the affected device;
- rotated critical secrets overnight, starting with the highest-impact credentials;
- said it had no evidence of impact on customer data, customer repositories or production systems;
- promised a full report once the investigation is complete.
A much bigger campaign
GitHub was the best-known victim of a broader wave. According to Tenable, the Mini Shai-Hulud campaign compromised more than 170 packages on npm and PyPI, totaling over 518 million weekly downloads. OX Security counted at least 400 GitHub repositories created to store stolen credentials. TeamPCP had been hitting the open-source ecosystem for months, and Google also lists it (as UNC6780) among groups targeting AI and development environments.
Note: some sources date the breach to June 2026. The correct date, according to GitHub and the security press, is May 19–21, 2026.
Lessons for any company
- IDE extensions are software with full access: keep an allowlist and block the rest.
- Auto-updates aren't always safe: 18 minutes was enough. Consider delaying extension and package updates by a few days.
- Protect maintainer accounts with security keys and short-lived tokens.
- Keep development machines away from production secrets.
- Have a plan to rotate secrets fast, as GitHub did.
Sources
- Help Net Security (2026-05-20): https://www.helpnetsecurity.com/2026/05/20/github-breached-teampcp/
- BleepingComputer: https://www.bleepingcomputer.com/news/security/github-investigates-internal-repositories-breach-claimed-by-teampcp/
- Dark Reading: https://www.darkreading.com/application-security/github-confirms-breach-4k-internal-repos-stolen
- Tenable, Mini Shai-Hulud FAQ: https://www.tenable.com/blog/mini-shai-hulud-frequently-asked-questions
Want to review the security of your development pipeline, from extensions to packages? KGA IT offers a free consultation: kga-it.com.