GitHub Confirms Breach of 3,800 Repos via Malicious VSCode Extension

GitHub's internal information was leaked, resulting in unauthorized access to approximately 3,800 repositories via a Visual Studio Code extension.

The news blog specialized in Japanese culture, odd news, gadgets and all other funny stuffs. Updated everyday.

GitHub says internal repos exfiltrated after poisoned VS Code extension attack

Initial assessment says customer data spared while users wonder what else may have slipped out

Mini Shai-Hulud Supply Chain Attack CVE-2026-45321 FAQ

A self-propagating worm has compromised more than 170 npm and PyPI packages, defeating provenance attestation and breaching OpenAI and Mistral AI. Here is what you need to know.Key takeawaysMini Shai-Hulud is a self-propagating worm by TeamPCP that steals developer and cloud credentials across the npm and PyPI ecosystems.The campaign achieved a critical security first by compromising packages with valid SLSA Build Level 3 provenance attestations…

GitHub Breach: Severe VS Code Supply Chain Attack

A severe GitHub breach has been confirmed, involving unauthorized access to thousands of internal repositories due to a single compromised workflow. As the reports go, the compromise began after a GitHub employee’s device was infected through a malicious Visual Studio Code extension installed on that machine, letting the attackers reach sensitive internal systems. The incident […]

GitHub, Grafana Labs breaches traced back to TanStack supply chain compromise

GitHub CISO Alexis Wales has named the malicious VS Code extension behind the breach they suffered at the hands of the threat group TeamPCP: Nx Console, a popular developer tool with 2.2 million installs. A malicious version of the otherwise benign extension was used to steal secrets and developer credentials, which were then used to move through CI/CD pipelines and exfiltrate around 3,800 of GitHub’s private code repositories. One missed token,…