GitHub Investigating TeamPCP Claimed Breach of ~4,000 Internal Repositories

GitHub investigates unauthorized access to ~4,000 internal repositories after TeamPCP threatened to sell source code on a cybercrime forum.

• •GitHub detected compromise via poisoned VSCode extension on employee device with no evidence of customer information impact
• •TeamPCP compromised durabletask PyPI package with self-replicating malware (Mini Shai-Hulud) harvesting cloud credentials and developer tool secrets
• •Malware propagates through AWS EC2 instances and Kubernetes clusters using stolen tokens, includes infostealer for 1Password, Bitwarden, SSH keys, and Docker credentials
• •Attack uses FIRESCALE mechanism to identify backup command-and-control servers by searching GitHub commit messages for encoded addresses
• •Durabletask package with ~417,000 monthly downloads executes malicious code automatically on import with no visible signs of compromise