BREAKING: GitHub Hit as TeamPCP Claims 4,000 Private Repos for $50K
BREAKING: A hacker crew calling itself TeamPCP says it has lifted source code from roughly 4,000 internal GitHub repositories.
Key takeaways
- A hacker group called TeamPCP claims to have stolen source code from roughly 4,000 internal GitHub repositories and is offering it on dark web forums for $50,000, threatening to release the full dataset for free if no one buys.
- GitHub confirmed the breach, attributing it to a poisoned VS Code extension installed on an employee device that acted as a backdoor allowing attackers to pivot into and move laterally through its internal network.
- Investigators say the intruders remained inside GitHub's systems for months before detection, though GitHub says it detected and contained the access within minutes once found.
- GitHub maintains the breach is scoped only to internal repositories and that customer private repos are not affected.
- Threat intel firm SlowMist flagged parallel supply chain attacks involving compromised npm packages (including AntV and Echarts-for-react) and the durabletask Python SDK, dubbed 'Mini Shai-Hulud' attacks.
BREAKING: A hacker crew calling itself TeamPCP says it has lifted source code from roughly 4,000 internal GitHub repositories.
The asking price on dark web forums: $50,000.
Sample files are posted as proof. The group says if nobody buys, the full dataset drops for free.
GitHub confirms the breach. The company says it detected and contained "unauthorized access to internal repositories" within minutes.
JUST IN: GitHub points the finger at a poisoned VS Code extension installed on an employee device. That extension acted as a backdoor.
Attackers used it to pivot into GitHub's internal network. From there they moved laterally and pulled data from repo after repo.
Investigators say the intruders sat inside for months before detection.
GitHub says the device is now isolated. The malicious extension version has been pulled. Full incident response is underway.
The company insists customer private repos are not affected. The breach, they say, is scoped to internal repositories only.
The hackers tell a different story. Their claim of 3,800 to 4,000 internal repos lines up loosely with GitHub's own internal probe.
Security researchers are watching the leak channels in real time.
DEVELOPING: Threat intel firm SlowMist flags parallel supply chain hits. Compromised npm packages including AntV and Echarts-for-react are in the mix. The durabletask Python SDK also caught in what researchers tag as "Mini Shai-Hulud" attacks.
Trigger date for one compromised npm account: May 19.
The pattern is the new normal. Trusted developer tools turned into delivery vehicles. Plugins. Extensions. SDKs. All weaponized.
Enterprises are scrambling to audit VS Code extensions across their fleets tonight.
Developers are pulling install logs. Security teams are rotating tokens. CISOs are calling emergency huddles.
The dataset has not surfaced publicly yet. The $50,000 clock is ticking.
GitHub says the investigation is ongoing. More disclosures expected in the next 24 hours.
We are tracking this live. Updates as they break.