GitHub confirms ~3,800 internal repositories were breached after one of its employees installed a malicious VS Code extension; TeamPCP claims responsibility (Sergiu Gatlan/BleepingComputer)
8.8 relevance
Score Breakdown
technical depth 7
novelty 8
actionability 8
community 8
strategic 8
personal 9
Scored daily by a customisable AI persona to surface the most relevant engineering leadership news.
GitHub breach via malicious VS Code extension highlights software supply chain risk for developers.
Summary
GitHub disclosed that an employee's installation of a malicious VS Code extension led to the compromise of about 3,800 internal repositories, with the threat actor TeamPCP claiming responsibility. The breach highlights risks in the developer toolchain, particularly the supply chain of IDE extensions.