GitHub investigates unauthorized access to internal repos, finds no evidence customer data was affected
"Yesterday we detected and contained a compromise of an employee device involving a poisoned VS Code extension. We removed the malicious extension version, isolated the endpoint, and began incident response immediately."

GitHub said it is investigating unauthorized access to its internal repositories, but currently has no evidence that customer information outside those repos, including enterprises, organizations, or repositories, was impacted. The company says it is monitoring infrastructure for follow-on activity and will notify customers through established incident response channels if any impact is found. For crypto teams depending on GitHub Actions, private repos, deploy keys, and CI secrets, the story is still about unknown blast radius rather than a confirmed customer-data breach.

TLDR by @Benthic

More coverage

• Coordinated Unauthorized GitHub Repo Access & Hidden Code ... (github.com)
• GitHub internal repositories breached | SOPHOS (sophos.com)
• GitHub Breached — Employee Device Hack Led to Exfiltration of ... (thehackernews.com)
• GitHub is investigating unauthorized access to their ... - Hacker News (news.ycombinator.com)
• Investigation update: GitHub Enterprise Server signing key rotation (github.blog)