GitHub Breach Exposes 3,800 Internal Repos via Poisoned VS Code Plugin
Software developers are increasingly becoming bigger targets for hackers, who are now searching for ways to compromise the software supply chain in an effort to distribute malware. The latest organization to be compromised is the developer platform GitHub, which had an employee get hit by a malicious Visual Studio Code Extension.
The company announced on the social media platform X that it “detected and contained a compromise of an employee device involving a poisoned VS Code extension. We removed the malicious extension version, isolated the endpoint, and began incident response immediately.” Once on the employee’s machine, the attacker was able to leverage this foothold to access roughly 3,800 internal repositories.
This attack was carried out by a group known as TeamPCP, which already has a track record of successfully targeting other developer focused platforms such as PyPI, NPM and Docker. The group is asking for $50,000 for those interested in...
Copyright of this story solely belongs to hothardware.com. To see the full text click HERE
