Research and tooling Northern Reach
Offensive security tooling, adversary emulation, research & analysis.

GitHub Internal Repositories Exfiltrated

Data Breach | HIGH severity Published 2026-05-20

Executive Summary

On May 18, 2026, GitHub detected and contained a compromise of an employee device that led to the exfiltration of approximately 3,800 internal repositories. The attack vector was a poisoned Visual Studio Code extension — later identified as Nx Console — installed as part of a broader TanStack npm supply chain attack. The threat actor TeamPCP listed the stolen source code for sale on a cybercrime forum with an asking price of $50,000, later joined by LAPSUS$ for a joint listing of $95,000.

GitHub confirmed the breach on May 20 and stated that no customer repositories, organizations, or enterprises were affected. The exfiltrated data was limited to GitHub's own internal repositories. However, those repos contained operational tooling, authentication workflows, infrastructure configurations, and excerpts of customer support interactions.

In response, GitHub rotated critical secrets, isolated the compromised endpoint, and initiated a GitHub Enterprise Server signing key rotation requiring action from all GHES administrators. The breach is linked to TeamPCP's broader Mini Shai-Hulud supply chain campaign, which has also compromised the durabletask PyPI package and multiple npm packages.

Timeline

Date Event Source
2026-05-18 GitHub detects compromise of employee device via poisoned VS Code extension; begins incident response GitHub Blog
2026-05-19 GitHub rotates critical secrets, continues log analysis GitHub Blog
2026-05-20 GitHub publicly confirms breach; TeamPCP lists stolen data on Breached forum for $50,000+ GitHub, BleepingComputer, Hacker News
2026-05-21 GitHub links breach to TanStack npm supply chain attack; Nx Console extension identified as vector GitHub, BleepingComputer
2026-05-22 LAPSUS$ joins TeamPCP; joint listing raised to $95,000; Durabletask PyPI package confirmed compromised by same actor Dark Web Informer, Wiz
2026-05-24 GitHub Enterprise Server signing key rotation begins; GHES admins instructed to rotate GPG keys GitHub Blog
2026-05-26 GitHub confirms ongoing investigation, advises GHES customers to prepare for increased security update cadence GitHub Blog

Technical Analysis

Affected Systems and Software

The exfiltration was limited to GitHub's own internal repositories — approximately 3,800 repositories containing source code, internal tooling, and infrastructure configuration. Affected categories included GitHub Actions, Copilot internal projects, CodeQL tools, internal infrastructure, security tools, and programs such as Codespaces and Dependabot.

No customer repositories, organizations, or enterprises were directly accessed. However, some internal repositories contained excerpts of customer support interactions.

GitHub Enterprise Server customers were indirectly affected: GitHub rotated the GHES signing key, requiring all GHES administrators to run a key rotation script to continue receiving and verifying updates.

Root Cause

An employee installed a malicious version of the Nx Console VS Code extension. This extension had been compromised as part of the TanStack npm supply chain attack. The poisoned extension provided the attacker with access to the employee's device and, from there, to GitHub's internal network and repositories.

TeamPCP, the threat actor behind this breach, has been running a sustained software supply chain campaign targeting the developer ecosystem — compromising npm and PyPI packages, hijacking maintainer accounts, and deploying the Mini Shai-Hulud self-replicating malware.

Attack Vector

The full kill chain:

  1. Supply chain compromise: Attackers compromised the TanStack npm package and the Nx Console VS Code extension distribution.
  2. Initial access: A GitHub employee installed the poisoned extension.
  3. Credential access: The extension harvested credentials and tokens from the employee's development environment.
  4. Lateral movement: Using stolen credentials, the attacker accessed GitHub's internal repositories and organizations.
  5. Exfiltration: Approximately 3,800 internal repositories were copied.
  6. Monetization: Data listed on Breached forum for $50,000, later raised to $95,000 in a joint listing with LAPSUS$.

Threat Actor

TeamPCP is a financially motivated threat actor group active since at least early 2026. Attribution is based on forum communications and operational patterns.

The group operates the Mini Shai-Hulud self-replicating malware, which targets developer environments, steals cloud and password manager credentials, and propagates through AWS SSM and Kubernetes. They have compromised multiple high-profile packages: durabletask (Microsoft PyPI), guardrails-ai, and multiple npm packages.

LAPSUS$ joined the sale of GitHub data on May 22. LAPSUS$ is a known extortion-focused group that previously targeted Microsoft, Okta, Nvidia, Samsung, and Ubisoft.

TeamPCP stated the data would be destroyed if a single buyer is found. If no buyer emerges, the data will be leaked at no cost. The group claims this was not a ransom attempt.

Malware Analysis

The credential stealer deployed through the durabletask package:

  • Capability: Harvests credentials from major cloud providers (AWS, GCP, Azure), password managers (1Password, Bitwarden), SSH keys, Docker credentials, VPN configuration, and shell history.
  • Propagation: Spreads to other EC2 instances via AWS SSM SendCommand and to other pods via kubectl exec. Uses stolen tokens for lateral movement.
  • Persistence: Installs as a dropper fetching second-stage payload from check.git-service[.]com with fallback to t.m-kosche[.]com.
  • C2 resilience: Uses FIRESCALE — searches GitHub public commit messages for backup C2 addresses encoded as base64.
  • Destructive capability: On systems with Israeli or Iranian locale settings, has a 1-in-6 probability of playing audio and running rm -rf /*.
  • Platform: Targets Linux systems. The durabletask package has approximately 417,000 monthly downloads.

Impact

End Users

No direct impact on individual GitHub users. Customer repositories and personal accounts were not accessed. However, users of the durabletask PyPI package (versions 1.4.1, 1.4.2, 1.4.3) should audit their environments and rotate credentials stored on any machine where the package was installed.

System Administrators

GitHub Enterprise Server administrators must rotate the GPG signing key immediately. Run the key rotation script from GitHub:

curl -fsSL https://enterprise.github.com/security/2026-05-24/rotate-gpg.sh -o rotate-gpg.sh
chmod ug+x ./rotate-gpg.sh
./rotate-gpg.sh
sudo ./rotate-gpg.sh

For HA or cluster topologies, run via ghe-cluster-each. SHA256 digest of the script: 3009bf5cdef034e153008cc375a05ac0bdbb1a2a325b22adb300c028e3766b43.

Without rotation, future GHES version upgrades will fail verification with: "Error: The file provided is not a valid GitHub Enterprise Server package."

Developers

The breach demonstrates supply chain risk through IDE extensions. Mitigations:

  • Audit installed VS Code extensions. Remove extensions that are not actively maintained or from unverified publishers.
  • Restrict extension auto-updates in development environments. Pin extensions to known-good versions.
  • Treat developer workstations as high-value targets. Separate development credentials from production access. Use hardware security keys.
  • Monitor for the durabletask package (versions 1.4.1–1.4.3). If installed, rotate all credentials accessible from affected machines — including cloud provider keys, password manager vaults, SSH keys, and Docker credentials.
  • Scan for Mini Shai-Hulud IOCs (see below).

Proof-of-Concept and Exploit Code

No public proof-of-concept or dedicated tooling found for this specific breach as of 2026-06-25. The attack used a supply chain compromise of an existing VS Code extension and the Mini Shai-Hulud credential stealer — both of which are operational malware, not publicly released exploit code.

Indicators of Compromise

File Hashes

None available from automated sources. The compromised VS Code extension version and the malicious durabletask packages (1.4.1, 1.4.2, 1.4.3) should be treated as indicators.

Network Indicators

Type Value Context
Domain check.git-service[.]com Mini Shai-Hulud primary C2
Domain t.m-kosche[.]com Mini Shai-Hulud fallback C2

YARA Rules

None found.

Suricata / Snort Signatures

None identified.

Sigma Rules

None found. Search SigmaHQ for community rules.

Threat Hunting Queries

Splunk — Detect connections to Mini Shai-Hulud C2 domains

index=network
| where dest_domain IN ("check.git-service.com", "t.m-kosche.com")
| table _time, src_ip, dest_ip, dest_domain, bytes_out

Sentinel KQL — Identify durabletask package installations

DeviceProcessEvents
| where ProcessCommandLine contains "durabletask"
| where ProcessCommandLine contains "1.4.1" or ProcessCommandLine contains "1.4.2" or ProcessCommandLine contains "1.4.3"
| project TimeGenerated, DeviceName, ProcessCommandLine, AccountName

Mitigation and Remediation

Immediate Actions

  1. GitHub Enterprise Server administrators: run the GPG key rotation script immediately on all nodes.
  2. Audit all machines for durabletask versions 1.4.1 through 1.4.3. Remove the package and rotate all credentials.
  3. Block outbound connections to check.git-service[.]com and t.m-kosche[.]com at the network perimeter.
  4. Scan VS Code extension inventories for unknown or recently updated extensions from unverified publishers.
  5. Review AWS SSM command history for unauthorized SendCommand invocations with the AWS-RunShellScript document.

Long-term Recommendations

  • Enforce allowed-lists for IDE extensions in enterprise environments.
  • Require hardware security keys for all developer accounts with access to production infrastructure or package registries.
  • Monitor PyPI and npm dependency trees for unexpected version bumps in packages maintained by small teams or single maintainers.
  • Implement code signing for internal tools and verify signatures before execution.

Vendor Advisories

References

  1. GitHub Blog — Investigation Update and Key Rotation — GitHub (2026-05-20 through 2026-05-26)
  2. GitHub confirms breach of 3,800 repos via malicious VSCode extension — BleepingComputer (2026-05-20)
  3. GitHub Breached — Employee Device Hack Led to Exfiltration of 3,800+ Internal Repos — The Hacker News (2026-05-20)
  4. GitHub hacked after poisoned VS Code extension infects employee device — Cybernews (2026-05-20)