This incident highlights the supply chain risks associated with developer tools like IDE extensions. It demonstrates the importance of rapid incident response, secret rotation, and endpoint isolation in mitigating the impact of a compromised internal environment.
On Monday May 18, we detected and contained a compromise of an employee device involving a poisoned VS Code extension published by a third party. We removed the malicious extension version, isolated the endpoint, and began incident response immediately.
Our current assessment is that the activity involved exfiltration of GitHub-internal repositories only. The attacker’s current claims of ~3,800 repositories are directionally consistent with our investigation so far.
We have no evidence of impact to customer information stored outside of GitHub’s internal repositories, such as our customer’s own enterprises, organizations, and repositories. Some of GitHub’s internal repositories contain information from customers, for example, excerpts of support interactions. If any impact is discovered, we will notify customers via established incident response and notification channels.
We moved quickly to reduce risk. We rotated critical secrets Monday and into Tuesday with the highest-impact credentials prioritized first.
We continue to analyze logs, validate secret rotation, and monitor our infrastructure for any follow-on activity. We will take additional action as the investigation warrants.
We will publish a fuller report once the investigation is complete.
The post Investigating unauthorized access to GitHub-owned repositories appeared first on The GitHub Blog.
Continue reading on the original blog to support the author
Read full articleManual repository governance is a security risk and operational bottleneck. Evergreen shows how to automate access control and lifecycle management using native GitHub features and Git-based state, ensuring a fail-secure environment without complex external databases.
This update demonstrates how shifting from individual records to aggregate data can solve both performance bottlenecks and security risks. It shows the importance of aligning API design with actual user needs—tracking trends rather than identities—to improve system scalability.
As AI agents move from experimental to production, engineers must solve critical challenges in context management, deterministic verification, and security. This overview provides a roadmap for building reliable, agentic systems while maintaining robust supply chain integrity.
Managing dependency updates is a critical but time-consuming maintenance task. Automating the initial triage with AI reduces cognitive load, ensures security patches aren't missed, and lets engineers focus on breaking changes rather than routine version bumps.
