GitHub confirmed overnight: TeamPCP exfiltrated 3,800 internal repositories via a poisoned VS Code extension.

WHAT GITHUB DISCLOSED

GitHub published its initial confirmation on the evening of May 19 in response to TeamPCP's cybercrime forum listing claiming access to GitHub's internal systems. The follow-up technical disclosure landed early May 20. The company's statement is direct. An attacker gained unauthorized access to GitHub-internal repositories. The current investigation assesses with directional confidence that approximately 3,800 repositories were exfiltrated. GitHub finds no evidence of impact to customer information stored outside its internal repositories, including customer enterprises, organizations, and user repositories.

The compromise vector is the operationally significant detail. GitHub's investigation revealed that a GitHub employee installed a malicious Visual Studio Code extension on a corporate endpoint. The extension's payload executed credential-stealing operations against the developer environment. Those harvested credentials granted programmatic access to GitHub's internal repositories. The attacker subsequently downloaded the 3,800 internal repositories at scale.

GitHub's incident response has been fast and substantive. The malicious extension version was removed. The affected endpoint was isolated. The company spent the overnight hours rotating high-impact credentials and cryptographic keys to revoke the attacker's access. Standard customer notification channels will activate if any customer impact is identified. The company has committed to ongoing transparency as the investigation continues.

GitHub has not formally named the specific malicious extension. Available technical reporting from Phoenix Security and StepSecurity indicates the strongest publicly available candidate, given timing, attribution, and operational characteristics, is the Nx Console / nrwl.angular-console v18.95.0 extension that StepSecurity flagged on May 19. The Nx Console extension has more than 2.2 million installations. The malicious version pulled a 498KB obfuscated payload from a dangling orphan commit in the official nrwl/nx GitHub repository. The payload is a multi-stage credential stealer that exfiltrates developer secrets via HTTPS, the GitHub API, and DNS tunneling.

WHO TEAMPCP IS

TeamPCP is a financially motivated cybercrime group that Google Threat Intelligence Group tracks as UNC6780. The group specializes in cross-ecosystem supply chain attacks targeting open-source security utilities, AI middleware, and developer tooling. Their 2026 campaign history is sustained and escalating, with each compromise enabling the next.

March 2026. TeamPCP compromised Aqua Security's Trivy vulnerability scanner via the GitHub Actions workflow path. The compromise harvested credentials that affected more than 1,000 downstream organizations including Cisco. The same credentials gave the group access to Checkmarx GitHub repositories.

March through May 2026. TeamPCP compromised Checkmarx across three distinct waves. The first wave produced the GitHub access and broader credential harvest. The second wave on April 22 produced malicious versions of the KICS Docker image, GitHub Actions workflows, and VS Code extensions on both Microsoft and Open VSX marketplaces. The third wave on May 9 produced the malicious Jenkins AST plugin version 2026.5.09 that Atarus covered on May 13.

March 2026. TeamPCP compromised the LiteLLM PyPI package, which Google's AI Threat Tracker named when it published the threat intelligence report Atarus covered on May 12. The LiteLLM compromise distributed TeamPCP's "Cloud Stealer" infostealer to tens of thousands of devices.

Throughout 2026. TeamPCP compromised the Bitwarden CLI npm package, Telnyx SDK, TanStack libraries, MistralAI repositories, and various other developer tooling components. The group deploys Mini Shai-Hulud, an adapted version of the self-replicating worm first documented in 2025, which automates the compromise propagation by stealing CI/CD credentials and using them to publish infected versions of further packages.

May 20, 2026. The GitHub compromise. The same group that has been escalating its supply chain campaign all year has now reached the apex target. GitHub hosts the source code for a substantial fraction of all modern software development. The same group that compromised the scanner, the gateway, the IDE extension, and the CI/CD plugin has now compromised the platform underneath all of them.

THE NX CONSOLE VECTOR

The likely vector deserves practitioner attention. The Nx Console / nrwl.angular-console VS Code extension is widely used. More than 2.2 million installations across the VS Code Marketplace. The legitimate extension provides a user interface for Nx, a popular build system and monorepo tooling solution. The compromised version 18.95.0 was published to the Microsoft VS Code Marketplace on May 18, 2026.

The compromise mechanism is sophisticated. The malicious code was not in the published extension package itself. The extension fetched a 498KB obfuscated payload at runtime from a dangling orphan commit hidden inside the official nrwl/nx GitHub repository. A dangling orphan commit is a Git commit that exists in the repository's object database but is not reachable from any branch reference or tag. The commit can be fetched directly by SHA hash but does not appear in normal repository browsing. The technique allows the attacker to host the payload inside the legitimate repository's GitHub infrastructure while remaining invisible to anyone reviewing the repository through standard interfaces.

The runtime execution flow is direct. Within seconds of a developer opening any workspace, the compromised extension silently fetches the obfuscated payload and executes it. The payload is a multi-stage credential stealer and supply chain poisoning tool. It harvests developer secrets including GitHub tokens, npm authentication tokens, AWS credentials, GCP service account keys, Azure credentials, Kubernetes service account tokens, SSH keys, Docker registry credentials, and any other secrets accessible to the developer environment. Exfiltration occurs through three channels in parallel: HTTPS to attacker-controlled domains, the GitHub API itself (using stolen GitHub tokens to publish to attacker-controlled repositories), and DNS tunneling for evasion.

The compromise propagation produces additional supply chain risk beyond the GitHub event itself. Any developer who installed Nx Console version 18.95.0 between May 18 and the takedown should treat every credential accessible to their workstation as compromised. Every package or repository the developer subsequently published may have been a vehicle for further TeamPCP propagation. The blast radius extends from a single VS Code extension on a single developer endpoint to the full set of downstream consumers of any software that developer touched during the exposure window.

WHY THIS MATTERS STRUCTURALLY

The Atarus blast radius synthesis on May 10 argued that capability is the easy part and that deployment architecture is the actual security posture. Today's GitHub compromise is the operational confirmation of that argument at the highest possible stakes. A VS Code extension is, by capability definition, a piece of editor tooling. Its design envelope includes reading workspace files, integrating with local development workflows, and providing developer convenience features. The compromise did not exceed that capability envelope. The extension did exactly what extensions are designed to do.

The blast radius is what determined the outcome. The extension had access to the developer's environment variables, credential stores, and authentication tokens. The developer's environment contained credentials with broad scope across GitHub's internal infrastructure. The blast radius of the extension was the union of those credentials. The compromise extracted the union. The 3,800 repositories were not exposed because the extension had repository access. The repositories were exposed because the extension had credential access that subsequently produced repository access.

The three failure modes the May 10 synthesis named all apply to the GitHub case. Over-granted agency: the extension had permissions to read the entire developer environment when its design purpose required only Nx-specific workspace integration. Unbounded process reach: the extension could access credentials, environment variables, and tokens far beyond its operational scope. Missing authentication boundaries: the VS Code Marketplace trust model authenticates publishers but does not authenticate individual extension versions against tampering with their own published packages. Each of these is a structural pattern. Each one applies to most VS Code extensions in production use. Each one applies to most IDE plugins, browser extensions, and developer tooling integrations across the entire software development ecosystem.

The defender response is structural rather than tactical. Patching GitHub is GitHub's work. The lesson for every other organization is to apply the blast radius review to your own developer tooling. What VS Code extensions, JetBrains plugins, browser extensions, and IDE integrations are in your developer environments? What credentials can they access? What is the recovery cost if any one of them is compromised tomorrow? The Atarus practitioner observation is that most organizations cannot answer these questions in less than a week of work, which is itself diagnostic.

INDICATORS AND TIMELINE

WHAT TO DO TODAY