GitHub Investigates VS Code Extension Supply Chain Hack
GitHub posted on X today, May 20, 2026, and stated that an attacker had used a compromised Visual Studio Code extension to access its internal repositories. The company says customer repositories and accounts outside GitHub’s internal systems don’t appear to be affected, but the platform is currently monitoring and rotating critical secrets.
How the Breach Started
GitHub’s investigation found an employee device was compromised after installing a poisoned VS Code extension. The malicious extension gave the attacker a foothold on the device, allowing them to access internal company code repositories.
GitHub detected the incident, removed the malicious extension, and isolated the affected device. The company then started its incident response procedures right away.
What Was Taken
GitHub’s current assessment is that the attacker exfiltrated only GitHub-internal repositories. The attacker claimed roughly 3,800 repositories, and GitHub says that this number is exactly what they have observed. Those repositories are internal to GitHub and do not include customer repositories stored outside of GitHub’s internal systems.
GitHub emphasized there is currently no evidence that customer data, like enterprise accounts, organization repositories, or private customer code, was accessed. However, the company is still analyzing logs and monitoring infrastructure for any follow-on activity that could indicate further exposure.
Immediate Actions GitHub Took
After discovering the intrusion, GitHub acted quickly to contain the threat and reduce further risk. The company immediately removed the malicious version of the VS Code extension and isolated the compromised system linked to the attack.
GitHub also launched its incident response process right away. The team began rotating important secrets and credentials, starting with the most critical ones on the same day the issue was discovered and continuing overnight to strengthen security.
In addition, the company kept reviewing logs and monitoring systems to confirm that the secret rotations and other security measures were working effectively.
Why Rotated Secrets Matter
When attackers access internal repositories, they can sometimes find API keys, tokens, or other credentials that let them move deeper into systems or access services. By changing those secrets quickly, GitHub limits what attackers can use even if they took copies. This is a standard containment step that helps prevent escalation after a breach.
What Customers Should Do
GitHub’s public updates say that customer repositories and accounts outside of GitHub’s internal systems do not show signs of being accessed. Still security experts recommend customers take these precautionary steps if they store API keys or credentials in code:
Developers and security researchers are asking users to review their repositories after the recent GitHub security scare. The main concern is exposed API keys, tokens and other sensitive credentials that could potentially be misused. Experts are advising users to remove any exposed secrets and rotate important keys as a safety measures.
Security teams are also encouraging developers to enable automated secret-scanning tools, switch on multi-factor authentication (MFA), and carefully review account activity and permissions for anything unusual.
The cybersecurity community reacted almost immediately after reports of the incident came up. Many professionals warned that even private repositories should not be treated as completely immune to leaks or exposure. GitHub also moved quickly, rotating critical credentials in an effort to limit possible damage.
According to GitHub, the investigation is still ongoing, and the company plans to publish a more detailed report once the review is complete.
Teams are currently checking logs and confirming that the affected credentials can no longer be exploited. The incident has once again highlighted the rising threat of supply-chain attacks, where compromised tools, extensions or dependencies can become entry points into trusted systems.
Also Read: CLARITY Act Stablecoin Talks Stall Before Senate Vote
