BREAKING: GitHub Hit as TeamPCP Claims 4,000 Private Repos for $50K

BREAKING: A hacker crew calling itself TeamPCP says it has lifted source code from roughly 4,000 internal GitHub repositories.

The asking price on dark web forums: $50,000.

Sample files are posted as proof. The group says if nobody buys, the full dataset drops for free.

GitHub confirms the breach. The company says it detected and contained "unauthorized access to internal repositories" within minutes.

JUST IN: GitHub points the finger at a poisoned VS Code extension installed on an employee device. That extension acted as a backdoor.

Attackers used it to pivot into GitHub's internal network. From there they moved laterally and pulled data from repo after repo.

Investigators say the intruders sat inside for months before detection.

GitHub says the device is now isolated. The malicious extension version has been pulled. Full incident response is underway.

The company insists customer private repos are not affected. The breach, they say, is scoped to internal repositories only.

The hackers tell a different story. Their claim of 3,800 to 4,000 internal repos lines up loosely with GitHub's own internal probe.

Security researchers are watching the leak channels in real time.

DEVELOPING: Threat intel firm SlowMist flags parallel supply chain hits. Compromised npm packages including AntV and Echarts-for-react are in the mix. The durabletask Python SDK also caught in what researchers tag as "Mini Shai-Hulud" attacks.

Trigger date for one compromised npm account: May 19.

The pattern is the new normal. Trusted developer tools turned into delivery vehicles. Plugins. Extensions. SDKs. All weaponized.

Enterprises are scrambling to audit VS Code extensions across their fleets tonight.

Developers are pulling install logs. Security teams are rotating tokens. CISOs are calling emergency huddles.

The dataset has not surfaced publicly yet. The $50,000 clock is ticking.

GitHub says the investigation is ongoing. More disclosures expected in the next 24 hours.

We are tracking this live. Updates as they break.