Post

2/ On Monday, we detected and contained a compromise of an employee device involving a poisoned VS Code extension. We removed the malicious extension version, isolated the endpoint, and began incident response immediately.

3/ Our current assessment is that the activity involved exfiltration of GitHub-internal repositories only. The attacker’s current claims of ~3,800 repositories are directionally consistent with our investigation so far.

4/ We moved quickly to reduce risk. Critical secrets were rotated on Monday and into Tuesday with the highest-impact credentials prioritized first.

what is github?

The dominant code management software platform. Sort of also social media for people who write code.

Calling GitHub “social media” is understating its impact. It is load bearing for a lot of software infrastructure. What this means is that security flaws in GitHub can end up as vulnerabilities (hacks) in the tech you use everyday, both directly and through websites.

Thanks for sharing this here @github.com 🙏