GitHub Data Breach: TeamPCP Exfiltrates 3,800 Internal Repos

On May 18, 2026, the threat actor group TeamPCP (also tracked as UNC6780) uploaded a poisoned Visual Studio Code (VS Code) extension, Nx Console version 18.95.0, to public marketplaces. This incident, detected by GitHub on May 19, 2026, led to the exfiltration of approximately 3,800 internal GitHub code repositories after compromising a GitHub employee's workstation, demonstrating how a mere 18-minute window of malicious availability for a trusted developer tool can steal critical infrastructure intelligence. shattered.io The attack flow, which used previously stolen credentials to publish the malicious extension, illustrates a continuous pattern of targeting developer environments for lateral movement into core systems.

What Happened

On May 18, 2026, TeamPCP (also tracked as UNC6780 and SHADOW-WATER-058) uploaded a poisoned version of the popular Visual Studio Code extension, Nx Console version 18.95.0, to the Visual Studio Marketplace and Open VSX. The malicious version was live for approximately 18 minutes shattered.io. During this brief period, VS Code’s silent auto-update feature distributed the compromised extension to developers with Nx Console installed, including at least one GitHub employee.

The initial access vector was stolen credentials belonging to an Nx developer, obtained through an earlier supply-chain attack on TanStack npm packages shattered.io. TeamPCP used these stolen credentials to publish the malicious extension. Once installed, the extension executed a shell command disguised as a routine setup task to harvest a wide array of credentials from the compromised machine. This included tokens, secrets, SSH keys, GitHub tokens (ghp_/gho_/ghs_), AWS credentials, npm tokens, 1Password vault contents, and other filesystem private keys shattered.io.

GitHub detected the breach on May 19, 2026, and initiated an immediate incident response. They isolated the affected endpoint, removed the malicious Nx Console extension, and rotated high-impact credentials overnight. Public confirmation of the incident followed rapidly on May 20, 2026, which GitHub reported as a quick turnaround for such a complex breach shattered.io. This vulnerability has been allocated CVE-2026-48027.

Why It Matters

This incident highlights how devastating supply chain attacks on developer tooling can be. TeamPCP did not require a zero-day in GitHub's core platform; compromising a trusted component in a developer's environment was sufficient. The exfiltration of approximately 3,800 internal GitHub code repositories is a significant loss, representing sensitive "infrastructure intelligence," including configurations, deployment scripts, staging credentials, and internal API schemas—all blueprints for GitHub's operational environment shattered.io.

GitHub stated there is no evidence of impact to customer information outside of its internal repositories, including customer enterprises, organizations, and user repositories. However, this infrastructure intelligence is valuable for sophisticated threat actors as it provides a roadmap for future, more targeted attacks, potentially allowing them to bypass defenses or discover new vulnerabilities. The compromise of credentials like AWS and 1Password vault data from an employee's machine means sensitive secrets were directly exposed. For organizations using tools like 1Password to secure credentials, this demonstrates that endpoint hygiene is as critical as password manager security.

TeamPCP demonstrated its intent by listing the stolen data for sale on the "Breached" cybercrime forum, with asking prices reportedly between $50,000 and $95,000 shattered.io. The group stated it was a sale to a single buyer and threatened to leak the data for free if no buyer emerged. This monetized exfiltration underscores the value of even "internal" data when it contains keys to a tech giant's kingdom.

Affected Scope & Remediation

The primary affected scope was any developer who installed or auto-updated to Nx Console version 18.95.0 of the Visual Studio Code extension during the 18-minute window it was available on May 18, 2026 shattered.io. Users running this specific version had their local system credentials and sensitive developer tokens harvested.

To mitigate this, ensure your Nx Console VS Code extension is not version 18.95.0. GitHub immediately removed the malicious version from the marketplaces, so any subsequent versions downloaded should be clean. If you suspect you were affected, or if you were running Nx Console and auto-updates were enabled on May 18, 2026, assume compromise and immediately rotate all credentials, tokens (especially GitHub ghp_/gho_/ghs_ tokens), and SSH keys on that machine. Consider a full system re-image.

We've allocated CVE-2026-48027 for this vulnerability.

Patch Links:

• NVD Entry: CVE-2026-48027
• GitHub Advisory: GitHub Data Breach 2026 (This blog post serves as the primary public advisory for the breach).
• CISA KEV Entry: Not currently listed in CISA's Known Exploited Vulnerabilities catalog as of June 19, 2026 (Checked on June 19, 2026, no new entries in the last 7 days).

Workarounds/Mitigations:
If a re-image isn't feasible, kernel-level telemetry from an EDR solution, like CrowdStrike Falcon, can help identify suspicious activity on developer workstations, but a complete credential rotation is paramount. Regularly audit installed VS Code extensions and disable auto-updates for critical development environments unless absolutely necessary and thoroughly vetted.

Timeline:

• Malicious Extension Live: May 18, 2026 (18 minutes)
• GitHub Detection & Incident Response: May 19, 2026 (1 day after upload)
• Public Disclosure: May 20, 2026 (2 days after upload)
• Reports still emerging as of: June 18, 2026

Technical Breakdown

The attack used a classic supply chain compromise (T1195.002 Compromise Software Supply Chain) combined with credential harvesting and exfiltration. TeamPCP first compromised an Nx developer's GitHub credentials via a prior supply-chain attack involving TanStack npm packages shattered.io. They then used these valid accounts (T1078 Valid Accounts) to publish the poisoned Nx Console extension. This is like a trusted delivery driver (the extension) being coerced into carrying a package of tools (the malicious payload) to your house. You open the door, thinking it's a legitimate delivery, but the package contains a mini-robot designed to scan your home for valuables.

Once installed, the malicious Nx Console version 18.95.0 extension executed a shell command. Visual Studio Code extensions operate with significant privileges, often having full access to the developer's machine shattered.io. This command was not part of the legitimate extension's functionality. It was designed to systematically scrape local storage for credentials (T1003 OS Credential Dumping). This included:

• GitHub tokens (ghp_/gho_/ghs_)
• SSH keys
• AWS credentials
• npm tokens
• Contents of 1Password vaults
• Anthropic Claude Code configurations
• Other filesystem private keys

These harvested credentials were then exfiltrated (T1041 Exfiltration Over C2 Channel) by TeamPCP. The sheer volume and variety of exfiltrated credentials demonstrate the thoroughness of the attack, aiming to establish persistent access and facilitate further lateral movement within GitHub's infrastructure. It gave them the keys to clone internal repositories, gaining "infrastructure intelligence" shattered.io.

This attack flow demonstrates that secure SA-10 Developer Configuration Management is vital, ensuring that the software development lifecycle, including extension publishing, is protected. It also demonstrates the need for SI-3 Malicious Code Protection on developer endpoints and effective IR-4 Incident Handling capabilities, which GitHub demonstrated by detecting and responding quickly.

Historical Context

The TeamPCP GitHub breach is part of a broader, escalating pattern of supply chain attacks targeting developer tools and infrastructure, a tactic TeamPCP itself has refined. This group, active since at least March 2026, has systematically compromised open-source security tools and developer infrastructure components shattered.io.

Before the GitHub incident, TeamPCP was known for attacks on the Trivy vulnerability scanner and Checkmarx KICS in March 2026. They followed this by compromising LiteLLM (March 2026) and the Bitwarden CLI (April 2026). In May 2026, they targeted numerous TanStack, Mistral AI, and other npm packages, which ultimately led to the compromise of the Nx developer's credentials used in the GitHub attack shattered.io. This continuous stream of attacks on developer-focused tools showcases a clear, persistent strategy: targeting the software supply chain to gain initial access, then moving laterally to exfiltrate valuable data. While the specific targets vary, the underlying methodology of poisoning trusted developer tools remains consistent.

Data at a Glance

The CVEDaily Take

GitHub's rapid detection and public disclosure are commendable, yet this incident proves that even top-tier security teams are vulnerable when developer endpoints become the weakest link. This was not a breach of GitHub's core platform; it was a breach of its intelligence – the blueprints and internal data that power its operations. The fact that the initial compromise was a previous supply chain attack on npm packages, leading to credentials for another supply chain attack (the VS Code extension), demonstrates a disturbing multi-stage pipeline of trust erosion. We think GitHub may be understating the long-term impact of losing this "infrastructure intelligence," as it could facilitate future, more targeted attacks against them or their customers. Has your organization implemented supply chain integrity checks for all developer tooling, including VS Code extensions, or are you still relying on implicit trust alone?

FAQ

Q: What specific version of Nx Console was malicious?
A: Nx Console version 18.95.0 was the poisoned version uploaded to the Visual Studio Marketplace and Open VSX on May 18, 2026 shattered.io.

Q: Did this breach affect customer data on GitHub.com?
A: GitHub states there is no evidence of impact to customer information outside of its internal repositories, including customer enterprises, organizations, and user repositories shattered.io. The exfiltrated data was GitHub's internal infrastructure intelligence.

Q: What should I do if my developer workstation had Nx Console installed around May 18, 2026?
A: Immediately rotate all GitHub tokens, SSH keys, AWS credentials, npm tokens, and any other sensitive credentials on that machine. Consider a full system re-image. Ensure your Nx Console extension is updated to a version other than 18.95.0, or remove and reinstall it shattered.io.