GitHub
Microsoft-owned code hosting platform that also runs npm, the JavaScript package registry.
GitHub tightened npm publishing rules on 2 October 2026, five months after a poisoned editor extension on one employee's laptop let attackers clone about 3,800 of its internal repositories.
Last refreshed: 12 October 2026 · Appears in 1 active topic
How did one VS Code extension reach 3,800 of GitHub's internal repositories?
Timeline for GitHub
Mentioned in: KEV three-day deadline share fell to 71%
Cybersecurity: Threats and DefencesAttack worm kit now open-sourced freely
Cybersecurity: Threats and DefencesGitHub's own code cloned via add-on
Cybersecurity: Threats and DefencesBackground
GitHub hosts source code for developers and companies and, through npm, runs the main registry for JavaScript packages. Holding both puts GitHub at two points of the software supply chain at once. The company is therefore an attractive target, as the May 2026 theft of its own repositories showed, and also the place where package-publishing safeguards get decided.
Microsoft paid $7.5bn for GitHub in 2018. After chief executive Thomas Dohmke said in August 2025 that he would leave, Microsoft folded GitHub into its CoreAI division instead of appointing a replacement.
GitHub's answer to the 2026 worm campaigns has come through npm policy. From 2 October 2026, a trusted-publishing configuration that has not completed its first publish lapses after 48 hours. The registry also now refuses publishing tokens issued to GitHub Actions issue_comment events, as it does for pull_request_target events.
GitHub's internal code leaked via one add-on
On 18 May a tampered release of the Nx Console extension for Visual Studio Code sat on the marketplace for 18 minutes. One GitHub engineer installed it; the ADD-on scooped up the credentials on that machine, and the intruders copied roughly 3,800 private GitHub repositories before access was cut. GitHub said the attackers reached no customer repositories or user data. Google tracks the attacker as UNC6780; under the name TeamPCP it put the stolen code up for sale.
The same CREW made GitHub's wider platform a target. After UNC6780 released its Shai-Hulud worm kit as open source on 12 May, a copycat contaminated 5,561 repositories using GitHub Actions within six hours.
Was GitHub hacked in 2026?
How did UNC6780 get into GitHub?
Did the GitHub 2026 breach affect customer code?
Why are VS Code extensions a security risk?
Who runs GitHub now?
Which VS Code extension was used to breach GitHub?
What changed in npm trusted publishing in October 2026?
