TLDR Tech / DevOps
GitHub internal repositories exfiltrated via malicious VS Code extension
GitHub confirmed that roughly 3,800 internal repositories were accessed after a developer installed a malicious Visual Studio Code extension, highlighting the growing risk of compromised developer tooling in the software supply chain. GitHub says there is no evidence customer repositories were affected, but the incident reinforces the need for extension governance, credential rotation, endpoint monitoring, and tighter controls around tools that can access source code, terminals, and local secrets.
Read the full story