Trending Now - Github Probes Security Breach Affecting 3,800 Repositories

WHO:

Techmeme - GitHub, TeamPCP (the group claiming responsibility for the breach)

WHAT:

VentureBeat - TeamPCP is advertising the stolen repositories for sale starting at $50,000.

VentureBeat - GitHub's assessment states that the attacker’s claim of ~3,800 repositories is “directionally consistent” with their investigation.

VentureBeat - GitHub confirmed that critical secrets were rotated overnight, prioritizing the highest-impact credentials first.

TechCrunch - GitHub stated that there is no evidence of customer data theft related to the breach.

Techmeme - GitHub confirmed a breach of approximately 3,800 internal repositories.

Cointelegraph - The unauthorized access involved the exfiltration of about 3,800 internal repositories.

Cointelegraph - GitHub removed the malicious code extension that caused the breach.

WHERE:

Techmeme - Internal repositories of GitHub.

WHY:

VentureBeat - The breach coincided with a new wave of the Mini Shai-Hulud supply chain worm, which forged valid cryptographic provenance on 639 malicious npm package versions.

Techmeme - The breach occurred after one of GitHub's employees installed a malicious VS Code extension.

HOW:

VentureBeat - The breach was facilitated by a poisoned VS Code extension installed on an employee’s device, which GitHub confirmed on May 20.

Techmeme - The breach was facilitated by the installation of a malicious VS Code extension by an employee.

(UPDATED May 20, 2026 19:43 UTC)

TeamPCP is now advertising stolen repositories for sale, starting at a price of $50,000, as GitHub confirms that the attacker’s claim of approximately 3,800 repositories aligns with their investigation. The breach occurred due to a poisoned VS Code extension installed on an employee’s device, with GitHub confirming this incident. Additionally, this breach coincided with a new wave of the Mini Shai-Hulud supply chain worm, which created valid cryptographic provenance for 639 malicious npm package versions.

--

(UPDATED May 20, 2026 13:54 UTC)

GitHub has announced that there is no evidence of customer data theft linked to the recent breach. This statement comes as a relief to many users concerned about the security of their information. The company continues to investigate the situation to ensure the safety of its platform.

--

(UPDATED May 20, 2026 10:05 UTC)

GitHub has confirmed a significant breach involving the unauthorized access and exfiltration of approximately 3,800 internal repositories, which was linked to a malicious VS Code extension installed by one of its employees. In response to the incident, GitHub has removed the harmful code extension that caused the security lapse. The group claiming responsibility for the breach is known as TeamPCP.