GitHub confirms data theft from internal repositories

GitHub, the code hosting and sharing giant owned by Microsoft, has confirmed that it was hacked, with attackers stealing data from around 3,800 internal code repositories. The security breach was initiated through a compromised employee device. The company stated that it detected and contained a compromise of an employee device involving a poisoned VS Code extension. The poisoned extension refers to a plug-in for Visual Studio Code, a popular code editor developed by Microsoft that programmers use to write and edit software code.

In a series of posts on X, GitHub, a code hosting and sharing giant, stated that it has “no evidence of impact to customer information stored outside of GitHub’s internal repositories,” though its investigation into the incident remains ongoing. Meanwhile, the cybersecurity publications The Record and Bleeping Computer reported that a hacking group called TeamPCP has taken credit for the GitHub breach. The hacking group is reportedly selling the stolen data on a cybercrime forum. GitHub did not immediately name the specific extension that was compromised in the attack.

This incident follows a pattern of cyberattacks targeting developer tools to compromise downstream systems. TeamPCP previously claimed credit for a data breach at the European Commission, which serves as the executive arm of the European Union. That breach resulted in the theft of more than 90 gigabytes of data from the commission’s cloud storage. In that previous incident, the hackers had stolen the European Commission’s cloud key during an earlier breach at Trivy, which is a vulnerability scanning tool, by pushing info-stealing malware to Trivy’s downstream users.

In a similar but separate attack, OpenAI was also targeted recently. In that incident, hackers broke into TanStack, which is a platform used by web developers, to push updates containing malware. This malware allowed the hackers to steal passwords and tokens from users. By targeting popular open-source projects and developer tools, hackers can compromise developer computers and their projects, allowing them to gain access to numerous systems simultaneously and magnify the impact of their attacks on downstream users.

Why it matters

The breach, executed via a poisoned VS Code extension, underscores a rising trend of attackers targeting popular open-source tools to compromise developer environments and their downstream projects.