In May 2026, a major security incident hit GitHub, the world's largest developer platform. The hacker group TeamPCP claimed on cybercrime forums that they had broken into GitHub's internal systems and stolen data from approximately 4,000 private repositories, including the platform's own proprietary source code and internal organization files. The stolen data is being offered for sale at over $50,000. GitHub confirmed the unauthorized access but stated that main services remain operational and no customer data outside these internal repos was affected.
How the Hack Worked: VS Code Extension as Entry Point
TeamPCP used a highly targeted attack vector — a poisoned VS Code extension. After a GitHub employee installed the malicious extension, the attackers gained system access. The security team quickly isolated the infected device and removed the extension, but the data had already been exfiltrated. GitHub states the stolen data is limited to its internal files, with no evidence that external user data was compromised.
TeamPCP: A Supply-Chain Attack Specialist Escalates
This is not TeamPCP's first major operation. The group gained notoriety earlier in 2026 for launching large-scale supply-chain attacks on tools like Trivy and Checkmarx to steal credentials. They particularly exploit GitHub Actions and developer workflows to extract sensitive access keys. Previous attacks successfully breached major companies such as Cisco. Now targeting GitHub directly and openly bragging about stealing Copilot's source code signals a sharp escalation in both capability and ambition.
The CVE-2026-3854 Flaw and AI Speculation
The breach came shortly after the disclosure of a critical remote code execution vulnerability CVE-2026-3854, discovered by Wiz Research. The flaw allowed users with basic push access to execute malicious code directly on GitHub's backend servers, potentially exposing millions of repositories. While GitHub patched its cloud servers quickly, many self-hosted enterprise instances remained vulnerable. Some in the crypto community suspect the hackers exploited this exact flaw; others float the involvement of Anthropic's Mythos AI model, known for advanced vulnerability research. Neither theory is confirmed, but developers are raising concerns about platform security under Microsoft's ownership.
What Developers Should Do Now
GitHub urges all users to immediately audit their repositories for leaked secrets and rotate API keys and digital tokens. The platform will directly notify affected customers. When it comes to VS Code extensions, only install from verified publishers and scan private repos frequently. GitHub is currently analyzing server logs to determine the exact scope of the theft and will publish a full report after investigation. Developers must stay alert — the software supply chain is clearly in the crosshairs.