GitHub Confirms Hack Impacting 3,800 Internal Repositories

"Our current assessment is that the activity involved exfiltration of GitHub-internal repositories only. The attacker's current claims of ~3,800 repositories are directionally consistent with our investigation so far. We continue to analyze logs, validate secret rotation, and monitor for any follow-on activity. We will take additional action as the investigation warrants, GitHub said, promising a full incident report at a later date."

"The intrusion, the platform said, was the result of an employee installing a poisoned VS Code extension. GitHub did not name the extension and did not share details on the type of data the compromised employee device contained. According to Aikido Security researcher Charlie Eriksen, VS Code extensions have full access to all data on a developer's machine, including credentials, SSH keys, cloud keys, and all other secrets."

"Boasting about the incident on an underground hacking forum, the threat actor claimed the theft of source code and internal orgs, offering the allegedly stolen information to any buyer willing to pay at least $50,000 for it. On Tuesday, the infamous hacking group TeamPCP, known for a series of recent supply chain attacks targeting the open source software community, claimed the hack of 4,000 GitHub internal repositories."

"GitHub launched an investigation into the matter shortly after and roughly five hours later confirmed the attackers' claims. The code-sharing platform immediately rotated critical secrets, prioritizing highest-impact credentials first. We continue to analyze logs, validate secret rotation, and monitor for any follow-on activity. We will take additional action as the investigation warrants, GitHub said."

GitHub confirmed that a supply chain attack impacted approximately 3,800 internal repositories. TeamPCP claimed responsibility for hacking about 4,000 internal repositories and offered allegedly stolen source code and internal organization data for at least $50,000. GitHub began an investigation and, about five hours later, said the claims were directionally consistent with its findings. GitHub assessed that the activity involved exfiltration of GitHub-internal repositories only. GitHub rotated critical secrets, starting with highest-impact credentials, and continued analyzing logs, validating secret rotation, and monitoring for follow-on activity. The intrusion was attributed to an employee installing a poisoned VS Code extension, and GitHub did not identify the extension or describe what data was on the compromised device.

Read at SecurityWeek