GitHub: 3,800 repos compromised by malicious VS Code extension

GitHub confirms breach of 3,800 internal repositories: the role of the supply chain attack

GitHub has officially linked the recent breach of its internal repositories to the supply chain attack on TanStack on npm, revealing that unauthorized access occurred through the installation by an employee of a compromised version of the Nx Console extension for VS Code.

Responding to the incident

The company confirmed that approximately 3,800 internal repositories were compromised. GitHub acted quickly by removing the malicious extension from the VS Code marketplace, isolating the compromised device, and immediately initiating incident response procedures.

TeamPCP's admission

The hacker group TeamPCP claimed responsibility for the attack on the cybercrime forum Breached, stating that they gained access to GitHub's source code and approximately 4,000 private repositories. The group demanded at least $50,000 for the stolen data, stating that they are not interested in extorting GitHub and that the data will be deleted if a buyer is not found within a certain period.

The context of VS Code extension breaches

This incident is not the first to involve malicious VS Code extensions. Over the years, several extensions with millions of installations have been used to steal development credentials and other sensitive data. For example, last year, VS Code extensions with 9 million installations were withdrawn due to security risks. Additionally, another 10 extensions, which posed as legitimate development tools, infected users with the XMRig cryptocurrency miner.

Implications for code security

GitHub is a cloud platform used by over 4 million organizations, including 90% of Fortune 100 companies, and more than 180 million developers who contribute to over 420 million code repositories. The breach underscores the importance of validating security surfaces to block threats, trigger detection rules, and maintain secure cloud configurations.

The history of TeamPCP

TeamPCP is known for carrying out massive supply chain attacks that have targeted developer code platforms such as GitHub, PyPI, npm, and Docker. More recently, the group has been linked to the "Mini Shai-Hulud" supply chain campaign, which also affected two OpenAI employees.

VS Code extensions as attack vectors

VS Code extensions are plugins that can be installed from the official marketplace to add functionality or integrate tools into the editor. However, their popularity makes them an attractive target for threat actors. Recently, two malicious extensions advertised as AI-based coding assistants with 1.5 million installations exfiltrated data from compromised developer systems to servers in China.

The challenges of extension security

Recent attacks highlight the challenges in securing VS Code extensions. Developers must be vigilant in installing extensions only from trusted sources and closely monitoring suspicious activities. Additionally, platforms like GitHub and VS Code must implement more robust security measures to prevent the insertion of malicious extensions into their marketplaces.

Implications for organizations

The GitHub breach serves as a reminder for organizations about the importance of implementing rigorous security practices to protect their code repositories. This includes using automated pentesting tools to assess the security of their cloud configurations and ensuring that security controls are able to block threats and trigger detection rules.

Lessons learned

The incident underscores the need for greater awareness and vigilance in managing VS Code extensions and protecting code repositories. Developers and organizations must stay updated on the latest threats and adopt proactive measures to mitigate security risks.

As GitHub continues to investigate the incident, organizations should reassess their security strategies to ensure they are adequate to face the evolving threats to supply chains and development environments.