… Link: GitHub confirms breach of 3,800 repos via malicious VSCode extension | https://www.bleepingcomputer.com/news/security/github-confirms-breach-of-3-800-repos-via-malicious-vscode-extension/ | BleepingComputer
Grafana says stolen GitHub token let hackers steal codebase By Bill Toulas May 18, 2026 09:46 AM Grafana Labs disclosed that hackers have downloaded its source code after breaching its GitHub environment using a stolen access token. …
… The hacker pivoted from Red Hat's npm packages to Microsoft's resources on GitHub. "The worm initially struck the @redhat-cloud-services npm namespace by compromising a Red Hat employee’s GitHub account. …
… "We are investigating unauthorized access to GitHub's internal repositories," GitHub told BleepingComputer when asked for further details. …
… The attacker's current claims of ~3,800 repositories are directionally consistent with our investigation so far." This comes after GitHub told BleepingComputer on Tuesday evening that it was investigating claims of unauthorized access to its internal repositories and added that it has no evidence t… …
… GitHub revealed the breach on Tuesday, saying it was investigating claims of unauthorized access to its internal repositories and telling BleepingComputer that the incident resulted from an employee installing a malicious Visual Studio Code VS Code extension, without disclosing the extension's name. …
… "This functionality is achieved by github.com POSTing over an OAuth token to github.dev that allows it to interact with GitHub on your behalf," Askar said . …
GitHub announces npm security changes to tackle supply-chain attacks By Bill Toulas June 10, 2026 03:41 PM GitHub has announced that npm v12, expected next month, will introduce several security-focused changes aimed at blocking supply-chain attacks abusing behaviors triggered by the 'npm install' … …
Clean GitHub repo tricks AI coding agents into running malware By Bill Toulas June 27, 2026 10:22 AM An agentic coding tool tasked with running a seemingly benign GitHub repository could execute a malicious payload that is invisible to both security agents and human reviewers. …
… But GitHub access can be more than access to code. …
