GitHub Confirms Security Incident: Malicious VS Code Plugin Compromises 3,800 Internal Repositories

According to GitHub official (@github), on May 20, 2026, GitHub detected a security incident triggered by employee devices being compromised through a malicious VS Code extension. The attackers exploited this extension to infiltrate employee devices and successfully exfiltrate data from approximately 3,800 internal GitHub repositories. GitHub responded swiftly by removing the malicious extension version, isolating infected endpoints, and rotating critical credentials on the day of the incident and overnight, prioritizing high-impact sensitive credentials. GitHub is currently continuing to analyze logs, verify the effectiveness of credential rotation, and monitor for any subsequent anomalous activity; a full report will be published upon completion of the investigation. GitHub has stated that, based on current assessments, this incident involved only the exposure of internal repository data, with no evidence indicating user data was affected.