Odaily Planet Daily reports: GitHub posted on X that it has shared additional investigation details regarding the unauthorized access to its internal repositories. Yesterday, GitHub detected and contained an incident involving compromised employee devices due to a malicious VS Code extension. GitHub has removed the malicious extension version, isolated the endpoints, and immediately initiated its incident response.
Current assessments indicate that the incident involved only the theft of internal GitHub repositories. The approximately 3,800 repositories claimed by the attacker are consistent with GitHub’s ongoing investigation. GitHub has acted swiftly to mitigate risk, rotating critical keys yesterday and overnight, and prioritizing the most impactful credentials. GitHub will continue analyzing logs, verifying key rotations, and monitoring for further activity, and will release a more comprehensive report upon completion of the investigation.