GitHub has officially confirmed, it is investigating a major security incident involving unauthorized access to its internal systems. The cyber threat actor group TeamPCP has listed thousands of GitHub’s private, internal source code repositories for sale on cybercrime forum.
What is Tanstack?
TanStack Query (formerly React Query) is a library that helps web applications easily fetch, store, update, and manage data from servers. It simplifies data handling by automatically caching data, syncing updates, and keeping your UI up to date.
Key Points: What Happened?
The Target: Roughly 4,000 internal private repositories belonging to GitHub itself.
- The Listing: The threat actors are offering the stolen source code for a flat buyout price of $50,000. They explicitly stated this is not an extortion or ransomware attempt, stating: “1 buyer and we shred the data on our end… if no buyer is found, we leak it for free.”
- The Root Cause: The breach was triggered by a highly sophisticated developer compromise. An internal employee’s device was infected via a malicious VS Code extension (Nx Console v18.95.0) that had briefly hijacked the Microsoft VS Code Marketplace.
- The Exploit Vector: The malicious extension silently executed a hidden, 498 KB obfuscated payload from a “dangling orphan commit” planted inside a trusted repository. This malware was a massive developer credential stealer that scraped GitHub Personal Access Tokens (PATs) and system memory.
Github confirmed on X
1/ We are sharing additional details regarding our investigation into unauthorized access to GitHub’s internal repositories.
Yesterday we detected and contained a compromise of an employee device involving a poisoned VS Code extension. We removed the malicious extension version,…
— GitHub (@github) May 20, 2026
The Impact: Who is Affected?
- Enterprise & Customer Data Safety: NO customer data, production systems, external enterprise accounts, or public/private user repositories are affected. GitHub’s core cloud infrastructure remains safe. The data exposure is strictly isolated to GitHub’s own internal private codebases.
- Cascading Supply Chain Worm: The threat actors are using the stolen credentials to power an aggressive, self-replicating malware campaign dubbed “Mini Shai-Hulud.”Wider Ecosystem Fallout: Using tokens scraped from this wave of developer breaches, TeamPCP has successfully poisoned several downstream packages, including official Microsoft Python packages on PyPI (durabletask versions 1.4.1 to 1.4.3).
On recent TanStack npm supply chain attack.
Grafana Labs confirmed a targeted attack by a cybercrime group that gained unauthorized access to our GitHub repositories and downloaded our codebase. They then issued a ransom demand under threat of data disclosure.
GitHub Threat Context & Statistics
| Metric | Current Scale | Security Risk |
|---|---|---|
| Active Developers | 100M+ global users | High volume of potential social engineering/phishing targets |
| Total Repositories | 420M+ hosted repos | Massive codebase volume to scan for leaked secrets |
| Weekly Actions Runs | Billions of CI/CD pipeline minutes | Primary target for memory scraping and token hijacking |
| Malicious Exposure Window | 11 to 18 minutes (for the rogue extension) | Long enough to compromise active developers with auto-update enabled |
What’s Now: Current Status & Remediation
GitHub’s security operations team responded instantly once the breach vector was identified:
- Infrastructure Hardening: GitHub immediately isolated the infected employee devices, wiped the malicious extension, and executed a sweeping, massive rotation of critical infrastructure credentials.
- Downstream Remediation: The malicious Nx Console extension has been completely purged from the VS Code Marketplace, and clean patches (v18.100.0+) have been deployed.
- Developer Advisory: If you are a software developer who had Nx Console version 18.95.0 auto-installed, you must treat your local system as compromised. Check your machine for persistent background processes (like cat.py or hidden kitty directories) and immediately rotate all cloud tokens, SSH keys, and password manager vaults.
