The Route Into GitHub Began Upstream
GitHub said it detected and contained a compromise of an employee device on May 18 involving a poisoned third-party Visual Studio Code extension. The activity involved exfiltration of GitHub-internal repositories only, and the attacker's claim of approximately 3,800 repositories was directionally consistent with the company's investigation.
The company also reported no evidence of impact to customer information stored outside its internal repositories. The entry point is what makes the incident unusual. GitHub's public account did not describe a direct compromise of its own platform or production systems. It centered on software running on a developer workstation: an editor extension installed through the same kind of channel developers use every day.
The trail runs backward from that employee device, through the compromised extension, and into an earlier supply-chain incident that set the route in motion.
