GitHub confirms 3,800 repositories were accessed through a malicious VS Code extension tied to earlier internal repo investigation

GitHub confirmed that a malicious VS Code extension led to unauthorized access affecting about 3,800 repositories. The report follows an earlier discussion about GitHub investigating access to internal repositories in May 2026.

The incident highlights how developer tooling has become a high-value attack path, especially when extensions have broad access to source code. Expect more scrutiny of extension supply chains, permissions, and enterprise controls around IDE integrations.

Previous thread in sequence:<p><i>GitHub is investigating unauthorized access to their internal repositories</i> - <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=48201316">https://news.ycombinator.com/item?id=48201316</a> - May 2026 (321 comments)