BlockBeats report: On May 20, GitHub released details of its investigation into an unauthorized access incident involving its internal repositories. The announcement stated that yesterday, GitHub detected and contained an attack on an employee device involving a malicious VS Code extension. GitHub has removed the malicious extension version, isolated the affected endpoints, and initiated an immediate incident response.
Current assessments indicate that the incident involved only the theft of internal GitHub repositories. The approximately 3,800 repositories claimed by the attacker are consistent with GitHub’s ongoing investigation. GitHub has acted swiftly to mitigate risk, rotating critical keys yesterday and overnight, and prioritizing the most impactful credentials. GitHub will continue analyzing logs, validating key rotations, and monitoring for further activity, and will release a more comprehensive report upon completion of the investigation.