VS Code extension compromise exposes thousands of GitHub repos; attackers sell data, CZ urges key rotation

Microsoft-owned GitHub confirmed that an attacker accessed thousands of its internal repositories after compromising an employee workstation through a malicious Visual Studio Code extension, with reports identifying about 3,800 internal repositories affected. GitHub has said its initial investigation found customer repositories, enterprise accounts and organizational data remain unaffected, while the company continues to probe the incident ^{[1] [2] [3]}.

A cybercrime group calling itself TeamPCP has claimed responsibility and is attempting to monetize the stolen internal data; reports say the group is seeking a minimum of $50,000 for access to the information ^{[2] [4]}.

Binance founder Changpeng “CZ” Zhao publicly urged crypto developers to immediately rotate API keys and other credentials stored in code repositories and to audit secrets after the breach, citing the heightened risk to projects that leave keys in code. Security guidance from multiple outlets and GitHub itself has emphasized changing exposed credentials and rotating tokens while the investigation continues ^{[1] [2] [5]}.

Developers and organizations using GitHub should assume exposed credentials may be compromised, rotate API keys and tokens, and follow official guidance from GitHub and security teams until the investigation is complete ^{[1] [5]}.