GitHub says internal repos exfiltrated after poisoned VS Code extension attack

"GitHub, the world's biggest code repository and DevOps platform, fell victim to a malicious Visual Studio Code (VS Code) extension. The company's initial assessment is that only internal repositories were exfiltrated. The incident was reported by GitHub on X, with follow-up posts revealing a "poisoned VS Code extension" as the cause. The Microsoft-owned code shack continues to "analyze logs, validate secret rotation, and monitor for any follow-on activity.""

"One GitHub post references "the attacker's current claims of ~3,800 repositories" as consistent with its investigation. This may refer to a post attributed to TeamPCP, the malware crew linked to the Shai-Hulud worm, the code for which has been published and caused widespread damage. In a post, the crew advertised GitHub's internal source code for sale, claiming around 4,000 repositories. They said it was not a ransom and if no buyer was found, they would leak the code for free. Claims like these should be treated with caution."

"A key concern for GitHub users is whether private repositories are at risk, either immediately or in the future if the attackers have gained a foothold into internal systems via stolen credentials. Risks include leakage of commercial code and credentials. Although best practice is not to check secrets into any repository, public or private, some organizations are less disciplined about this when repositories are private."

"Last month, Wiz Research discovered a remote code execution flaw in GitHub.com and GitHub Enterprise Server (the self-hosted version), which the researchers said was "remarkably easy to exploit." The vulnerability was discovered using AI. Developer reactions to GitHub's latest problems combine alarm and resignation - plus some humor. "How did the attackers find a large enough uptime window to get in?" quipped one."

A malicious Visual Studio Code extension caused GitHub to experience data exfiltration. GitHub’s initial assessment indicated that only internal repositories were taken. GitHub reported the incident and stated that it is analyzing logs, validating secret rotation, and monitoring for follow-on activity. The investigation referenced attacker claims of roughly 3,800 repositories, consistent with the scope of the compromise. A related malware crew previously advertised GitHub internal source code for sale, claiming around 4,000 repositories, while stating it was not a ransom. Users are concerned about whether private repositories were affected now or later through stolen credentials. Risks include leakage of commercial code and credentials, especially where secrets are stored in private repositories. Separate research previously found a remote code execution flaw in GitHub.com and GitHub Enterprise Server that was described as easy to exploit.

Read at theregister