GitHub said attackers gained unauthorized access to about 3,800 internal repositories through a compromised VS Code extension. The company said it detected the activity on May 19, removed the affected extension from its systems, and disabled related access points. For now, GitHub said there is no direct evidence that user repositories, organization accounts, or customer data were impacted.
Credential rotation and log review are still under way
According to GitHub, the incident appears to be limited to internal repositories rather than user-facing systems. The company said it has already rotated its most sensitive credentials and access keys, and plans to add more security controls as the picture becomes clearer. The investigation remains open. GitHub is reviewing system logs and checking how effective the credential resets have been before publishing a full report.
The sequence of response matters here. GitHub first removed the compromised component, then shut down connected access routes, and moved on to key rotation. Fast containment steps were visible early, but the exact scope is still being assessed.
UNC6780 linked to the attack, stolen materials reportedly listed for sale
The breach has been tied to threat group UNC6780. Google Threat Intelligence Group said the operators, known as “TeamPCP,” are associated with financially motivated supply-chain attacks aimed at software development pipelines. Reports cited in the source say the group obtained source code and internal data from nearly 4,000 private GitHub repositories tied to the company’s core infrastructure and is offering those materials for more than $50,000, possibly with samples shared as proof.
Google’s threat researchers said TeamPCP focuses on automated authentication processes, software delivery chains, and developer tooling as entry points. The source also notes that earlier in 2026, the group used the Trivy Vulnerability Scanner flaw CVE-2026-33634 in attacks that affected major companies including Cisco. It has also been linked to credential phishing campaigns aimed at security software firms such as LiteLLM and Checkmarx.
Crypto infrastructure concerns center on API exposure
Binance founder Changpeng Zhao said the incident should push development teams to take immediate security steps, warning that the effects could spread into the crypto sector through shared API infrastructure. For exchanges, custody providers, and data platforms, storing API keys, automation tokens, or CI/CD credentials inside core repositories can turn a single supply-chain weakness into a broader operational problem.
The examples in the report show how that risk changes by service. CoinStats API is tied to portfolio management, CoinGecko API to pricing and market data, and Infura to blockchain node access. If credentials are exposed, the reported risks range from user fund exposure and false pricing flows to service outages and network exploitation.
The article also names CoinGecko API, CoinMarketCap API, Infura, Alchemy, Kaiko, and Bitquery as platforms that have captured larger market share recently. Security specialists cited in the source urged developers to audit the API backends behind these tools on a regular basis and handle credentials according to current best practices, given how central those services are to monitoring and security workflows.