GitHub is investigating unauthorized access to internal repositories after TeamPCP claimed it had GitHub source code and internal organizations for sale. GitHub said the current assessment points to exfiltration of GitHub internal repositories only, and that the claimed count of roughly 3,800 repositories is directionally consistent with its investigation. [1]
Read that again.
Not customer repositories. Not public drama. Internal GitHub repositories. The kind of place where secrets, workflow assumptions, developer habits, architecture clues, and operational reality tend to live whether anybody wants to admit it or not.
GitHub also said the compromise involved an employee device and a poisoned Microsoft Visual Studio Code extension. [1] The company did not publicly name the extension in that statement, but the timing lands right beside the Nx Console compromise, where version 18.95.0 of a popular VS Code extension was published with malicious code targeting developer credentials, cloud tokens, and CI/CD secrets. [2]
That is the part that should make every security team sit up straight.
This was not some exotic nation state magic trick from a movie. This was a developer extension. A thing people install because it makes work easier. A thing that lives inside the workflow. A thing that gets trusted because the marketplace looks clean, the name looks familiar, and everybody is moving too fast to ask the ugly question.
Who reviewed the damn code before it landed?
StepSecurity reported that the compromised Nx Console extension had more than 2.2 million installs, fetched and executed an obfuscated payload after a developer opened a workspace, and harvested secrets from GitHub, npm, AWS, HashiCorp Vault, Kubernetes, and 1Password. [2] That is not a harmless extension bug. That is a weapon dropped directly into the developer nervous system.
This is the new normal, and that is the problem.
The Nx ecosystem was already hit in August 2025, when malicious Nx and related package versions were pushed to npm. The official GitHub advisory told affected users to rotate credentials and tokens, revoke GitHub access, remove malicious versions, clear package manager caches, and purge compromised packages from internal registries. [3] In other words, the blast radius was not theoretical. It was real enough that the cleanup instructions read like incident response, because that is exactly what it was.
Then the attacks kept coming.
Snyk reported that on May 11, 2026, 84 malicious npm package artifacts were published across 42 packages in the TanStack namespace. The packages were published by the legitimate TanStack release pipeline after attacker controlled code hijacked the runner mid workflow. [4] That detail matters. The attacker did not need to look fake. The attacker used the real pipeline.
OX Security reported that the renewed Shai Hulud campaign hit more than 170 npm and PyPI packages, with affected projects including Mistral AI, OpenSearch, and TanStack. OX also reported more than 518 million accumulated monthly downloads across affected packages. [5]
That is not a bad week. That is an ecosystem coughing blood.
The durabletask PyPI compromise makes the same point from the Python side. The Hacker News reported that malicious durabletask versions 1.4.1, 1.4.2, and 1.4.3 were identified, and that Wiz said the attacker used a previously compromised GitHub account to dump repository secrets and gain access to a PyPI token. [1] That is the chain. One compromise feeds the next. One stolen token becomes a package release. One package release becomes another developer box. One developer box becomes another repository. Around and around we go.
And somehow the industry still wants to talk about this like it is an edge case.
It is not.
Developer machines are production systems now. CI/CD pipelines are production systems now. Extensions are supply chain dependencies now. Package managers are execution engines now. If a tool can read code, execute scripts, access tokens, touch build workflows, or live inside an IDE, then it is not just a convenience. It is part of the attack surface.
Security teams have spent years obsessing over endpoints while treating developer tooling like sacred ground. That fantasy is dead.
The attacker does not need to break into production if they can poison the path that builds production. They do not need to phish the customer if they can own the maintainer. They do not need to defeat your cloud controls if they can steal the tokens before those controls ever get a vote.
This is why these attacks feel so dirty. They weaponize trust. They use the muscle memory of modern development against us. Install the extension. Pull the package. Run the build. Trust the pipeline. Ship the code.
Bang.
The fix is not another poster about awareness. The fix is not pretending every developer can manually audit every dependency while deadlines are on fire. The fix starts with admitting that trust without verification is just a breach waiting for a calendar invite.
Extensions need review. Package updates need delay windows. CI/CD workflows need least privilege. Tokens need short lives. Secrets should not be sitting around like loose cash in a biker bar parking lot. Provenance matters, but even provenance can be abused when the legitimate pipeline is hijacked. Snyk specifically noted that the TanStack incident produced malicious packages with valid SLSA provenance because the real build process was compromised. [4]
That should scare people.
Not because SLSA is useless. It is not. Not because signing is useless. It is not. It should scare people because attackers are moving up the stack. They are not just trying to forge trust anymore. They are trying to become the trusted process.
That is the shift.
The GitHub incident, the Nx Console compromise, the earlier Nx npm attack, the TanStack wave, and the PyPI durabletask compromise all point in the same direction. The development environment is now an active battlefield. The IDE is a beachhead. The package registry is a weapons depot. The build pipeline is a launch platform.
We can keep acting surprised every time this happens, or we can grow up.
Because this is getting way too normalized.
Not normal as in acceptable. Normal as in frequent. Normal as in predictable. Normal as in every serious organization should already assume that a developer tool, extension, package, workflow, or token will be targeted next.
The next breach will not announce itself with a skull banner and a movie soundtrack. It will look like a routine install. It will look like a trusted extension. It will look like a patch. It will look like work.
That is what makes it dangerous.
That is also why the answer has to be brutal and boring. Review the code. Restrict the permissions. Kill standing credentials. Monitor extension installs. Lock down package sources. Audit CI/CD. Treat developer endpoints like high value targets. Assume compromise faster. Rotate secrets harder. Stop giving tools god mode because they have a nice logo and a million installs.
The supply chain is not some abstract risk sitting in a compliance slide. It is the road your software drives on. Right now, that road is full of landmines, and too many companies are still flooring the gas.
About the Author
Len Noe is a Solutions Architect at BeyondTrust, Transhuman, Podcaster, International Cyber Security Speaker, Author, Technical Evangelist, and Biohacker with 11 implanted microchips. A former blackhat and ex-1% motorcycle club member with more than 30 years in technology, he has presented in over 70 countries and is featured in the documentary I Am Machine, which premiered at DEF CON 2025.
https://www.i-am-machine.com
References
[1] The Hacker News, “GitHub Breached — Employee Device Hack Led to Exfiltration of 3,800+ Internal Repos,” May 20, 2026.
https://thehackernews.com/2026/05/github-investigating-teampcp-claimed.html
[2] StepSecurity, “Nx Console VS Code Extension Compromised,” May 18, 2026.
https://www.stepsecurity.io/blog/nx-console-vs-code-extension-compromised
[3] GitHub Advisory Database, “Malicious versions of Nx were published,” CVE 2025 10894.
https://github.com/advisories/GHSA-cxm3-wv7p-598c
[4] Snyk, “TanStack npm Packages Compromised Inside The Mini Shai Hulud Supply Chain Attack,” May 11, 2026.
https://snyk.io/blog/tanstack-npm-packages-compromised/
[5] OX Security, “Shai Hulud, Here We Go Again: 170+ Packages Hit Across npm & PyPI,” May 12, 2026.
https://www.ox.security/blog/shai-hulud-here-we-go-again-170-packages-hit-across-npm-pypi/