Back to Devoured - May 20, 2026
DEVOURED
GitHub is investigating unauthorized access to its internal repositories

GitHub is investigating unauthorized access to its internal repositories

Tech securitydevopsgithub GitHub
GitHub is investigating unauthorized access to its internal repositories, confirming initial activity involved a poisoned VS Code extension on an employee device.
What: GitHub is investigating unauthorized access to its internal repositories, detected and contained on May 19. The compromise originated from a poisoned VS Code extension on an employee device, leading to exfiltration of GitHub-internal repositories, with the attacker claiming around 3,800 repositories. Critical secrets were rotated immediately.
Why it matters: This incident highlights the persistent insider threat vector from compromised employee devices and the increasing sophistication of supply chain attacks targeting developer tools, even within major tech companies.
Takeaway: Developers should be cautious about installing third-party extensions, even from official marketplaces, and organizations should implement strict supply chain security for internal tools and employee devices.
Deep dive
  • On May 19, GitHub detected and contained unauthorized access to its internal repositories.
  • The compromise was traced to a poisoned VS Code extension installed on an employee's device.
  • GitHub promptly removed the malicious extension version, isolated the affected endpoint, and initiated incident response.
  • Initial assessment indicates that the activity involved the exfiltration of GitHub-internal repositories only.
  • The attacker's claim of approximately 3,800 repositories being accessed is "directionally consistent" with GitHub's investigation.
  • GitHub rotated critical secrets and high-impact credentials immediately following the discovery.
  • There is currently no evidence of impact to customer information stored outside of GitHub's internal repositories (e.g., customer enterprises, organizations, or repositories).
  • GitHub is closely monitoring its infrastructure for any follow-on activity and will notify customers via established channels if any impact is discovered.
Decoder
  • VS Code extension: A software package that adds new features or functionality to Visual Studio Code, a popular source-code editor developed by Microsoft.
Original article

We are investigating unauthorized access to GitHub’s internal repositories. While we currently have no evidence of impact to customer information stored outside of GitHub’s internal repositories (such as our customers’ enterprises, organizations, and repositories), we are closely monitoring our infrastructure for follow-on activity.

If any impact is discovered, we will notify customers via established incident response and notification channels.

We are sharing additional details regarding our investigation into unauthorized access to GitHub's internal repositories. Yesterday we detected and contained a compromise of an employee device involving a poisoned VS Code extension. We removed the malicious extension version, isolated the endpoint, and began incident response immediately.

Our current assessment is that the activity involved exfiltration of GitHub-internal repositories only. The attacker’s current claims of ~3,800 repositories are directionally consistent with our investigation so far.

We moved quickly to reduce risk. Critical secrets were rotated yesterday and overnight with the highest-impact credentials prioritized first.

Bring GitHub Agentic Workflows to your repo. Explore 6⃣ ways to automate your repo with these continuous workflows today 🧵👇

Automatically summarize, label and route new issues

Proactively keep READMEs and documentation up to date with recent code changes

How is generative AI affecting software developers?

A thread 🧵

Generative AI coding tools are trained on large amounts of code across programming languages. They’re trained to process data like humans do—by recognizing patterns, making connections, and drawing inferences with limited guidance.

Generative AI coding tools are powered by large language models (LLMs). Today’s state-of-the-art LLMs are transformers, which makes them adept at connecting tokens, big-picture thinking, and scaling. The results are coding and content suggestions that are contextually relevant.

Looking to improve your accessibility skills? Here are some simple steps that all developers can take to automatically increase accessibility. 🧵

1. Unplug your mouse. That's right, unplug it and see whether you can still navigate whatever you're building without touching it.

2. Make sure your code meets basic accessibility guidelines, such as the Web Content Accessibility Guidelines - w3.org/WAI/standards- guidelines/wcag/glance/

Looking to level up your skills in 2023? This 🧵 is for you.

Learn how to manage your time as a software engineer with these 7 essential habits. github.com/readme/guides/time-management-software-engineers

Turn potential into creative productivity with the 4 Cs: Consume, Curate, Critique, Create. github.com/readme/guides/intentional-creation

What were you doing 10 years ago?

When we released our first Octoverse report 10 years ago we were celebrating 2.8m people on GitHub. Now we have over 94m. We never could have predicted the impact open source would have on the world.

In 2012, most businesses were only using open source software (OSS) to run their web servers. Big-name projects, such as Kubernetes and Docker hadn't even been released yet.

Explore all 51 articles in today's digest

Fresh dev news, AI-digested daily. Never miss a trend at devoured.fyi