GitHub Investigates Unauthorized Access to Internal Repositories

On Monday, May 18, GitHub detected that one employee device had been compromised due to a third-party distributed poisoned VS Code extension. The malicious extension version was removed, the endpoint was isolated, and incident response began immediately.

The current investigation indicates that only GitHub's internal repositories appear to have been exposed, and the figure of about 3,800 repositories claimed by the attacker largely matches. There is no evidence so far that customers' own enterprise accounts, organizations, or repository information were affected.

However, some internal repositories may contain customer information such as portions of customer support conversations. GitHub has taken the following steps to reduce risk:

• Rotated critical secrets on a priority basis from Monday through Tuesday
• Continued log analysis and secret verification
• Strengthened monitoring for follow-on activity across infrastructure

If additional impact is confirmed, customers will be notified through existing incident response and notification channels, and a more detailed report will be published once the investigation is complete.