GitHub confirmed an attacker was able to access its internal repositories after a code extension breach, with TeamPCP claiming credit.

On May 20, 2026, GitHub announced that employee devices had been compromised by a 'VS Code extension containing malicious code,' resulting in data from internal GitHub repositories being transmitted ...

Key details are still missing, but Trellix says it found no evidence of source code release or distribution process being affected.