GitHub confirmed that a poisoned VS Code extension on an employee's device gave attackers access to roughly 3,800 internal repositories.

Source Brief

GitHub confirmed that a poisoned VS Code extension on an employee's device gave attackers access to roughly 3,800 internal repositories. The threat group TeamPCP is already advertising the stolen data — an alarming incident for software supply chain security.