GitHub Internal Breach — TeamPCP Exfiltrates 3,800+ Repos via Poisoned VS Code Extension Tied to Mini Shai-Hulud Worm
GitHub Internal Breach (TL-2026-0536), also tracked as Mini Shai-Hulud (durabletask wave), is a critical-severity supply-chain compromise, first published 2026-05-20. It is attributed to TeamPCP with medium confidence, affects Microsoft durabletask (PyPI), maps to 31 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 26 indicators of compromise.
Key facts for TL-2026-0536
- Threat ID
- TL-2026-0536
- Also known as
- Mini Shai-Hulud (durabletask wave), GitHub Internal Repo Leak May 2026, TeamPCP GitHub Breach
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-05-20
- Last reviewed
- 2026-05-20
- Attribution
- TeamPCP
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- technology, software-development, cloud-services, open-source-ecosystem, ci-cd-infrastructure, financial-services, government
- Target regions
- Global, North America, Europe, Asia-Pacific, Middle East (destructive overlay targets Israeli and Iranian locales)
- Detection rules
- 9
- Indicators of compromise
- 26
Malware and tooling in GitHub Internal Breach
Malware and tooling: Mini Shai-Hulud, rope.pyz
Threat actor TeamPCP compromised a GitHub employee device via a poisoned Microsoft Visual Studio Code extension and exfiltrated approximately 3,800 GitHub-internal source repositories, which were subsequently listed for sale on a cybercrime forum for $50,000. The intrusion is tied to TeamPCP's concurrent Mini Shai-Hulud supply-chain worm campaign that poisoned Microsoft's official durabletask PyPI package (versions 1.4.1, 1.4.2, 1.4.3) and over 172 npm/PyPI packages with combined downloads exceeding 518 million. GitHub confirmed the breach scope and rotated critical secrets; the campaign represents one of the largest cross-ecosystem supply-chain compromises observed in 2026.
How GitHub Internal Breach works
On May 20, 2026, GitHub publicly confirmed that an unauthorized actor obtained access to internal-only GitHub repositories after threat actor TeamPCP began advertising approximately 4,000 repositories for sale on an underground forum for a minimum of $50,000. TeamPCP framed the offering as 'not a ransom' and warned that the data would be leaked freely if no buyer was found. An associated X account ('xploitrsturtle2') publicly taunted GitHub for delayed disclosure. GitHub's investigation found the attacker's claims 'directionally consistent' with the impact (~3,800 repositories) and attributed the initial access vector to a poisoned Microsoft Visual Studio Code extension installed on an employee device. GitHub stated the activity involved 'exfiltration of GitHub-internal repositories only' with no current evidence of customer data exposure.
The GitHub breach is operationally linked to TeamPCP's broader Mini Shai-Hulud campaign — a self-replicating supply-chain worm that is the direct evolutionary descendant of the original Shai-Hulud npm worm and the earlier transformers.pyz payload used in the guardrails-ai compromise. On May 19, 2026, the worm operators published trojanized versions 1.4.1, 1.4.2, and 1.4.3 of Microsoft's official durabletask Python SDK (the Python client for the Durable Task workflow framework, ~417,000 monthly downloads). Within approximately five hours, TeamPCP pushed over 400 malicious versions across 172 distinct packages spanning the npm and PyPI ecosystems, hitting major projects including TanStack, Mistral AI, OpenSearch, Guardrails AI, and UiPath.
The malicious durabletask wheel injects loader code into multiple entry points (task.py, entities/__init__.py, extensions/__init__.py, payload/__init__.py) so the implant runs the instant the package is imported, with no error messages or visible compromise. The loader fetches a 28KB Python ZIP application named rope.pyz from the C2 hosts check.git-service[.]com (primary) and t.m-kosche[.]com (fallback), with legacy infrastructure also resolving to 83.142.209.194. The dropper writes to /tmp/rope-*.pyz, executes as python3 /tmp/managed.pyz, and drops infection markers at ~/.cache/.sys-update-check (general) and ~/.cache/.sys-update-check-k8s (Kubernetes). The implant targets Linux exclusively.
rope.pyz is a Linux credential stealer with broad reach: it harvests AWS IAM credentials, Azure service-account tokens, and GCP service tokens; reads HashiCorp Vault KV secrets; unlocks and dumps 1Password and Bitwarden vaults (brute-forcing master passwords using harvested credential dictionaries when needed); enumerates pass/gopass stores; collects SSH private keys, Docker config credentials, VPN configurations, kubeconfig files, and shell history (.bash_history, .zsh_history). The worm then propagates two ways: (1) in AWS, after harvesting credentials, it enumerates SSM-managed instances and uses ssm:SendCommand with the AWS-RunShellScript document to execute rope.pyz on up to five other EC2 instances per profile; (2) in Kubernetes, it uses kubectl exec to drop and run the payload inside reachable pods, marking infected containers with the k8s-specific marker.
A novel component is FIRESCALE — a dead-drop resolver that searches GitHub's public commit-message corpus for the regex pattern 'FIRESCALE <base64_url>.<base64_signature>'. When primary C2 is blocked, the implant pulls operator-signed C2 addresses out of attacker-controlled commits, effectively turning GitHub itself into resilient C2 infrastructure that cannot easily be sinkholed at the DNS or IP layer. The campaign also includes a destructive overlay: when the implant detects an Israeli (he_IL) or Iranian (fa_IR) locale, there is a one-in-six chance it plays an audio file and then executes 'rm -rf /*', wiping the host. This ideological/destructive selector co-exists with the financially motivated repo-sale operation, leaving attribution motive mixed.
Defensive priorities: (1) audit all hosts that pulled durabletask 1.4.1-1.4.3 since May 19, 2026 and rotate ALL credentials reachable from those hosts (cloud, vault, password manager); (2) hunt for rope.pyz / managed.pyz file artifacts and the .sys-update-check markers; (3) block check.git-service.com, t.m-kosche.com, and 83.142.209.194 at the perimeter; (4) inspect AWS CloudTrail for ssm:SendCommand with AWS-RunShellScript invocations from unexpected principals; (5) inspect Kubernetes audit logs for kubectl exec from compromised service accounts; (6) hunt outbound HTTPS to api.github.com fetching commit messages with FIRESCALE patterns; (7) audit VS Code extensions installed on developer endpoints for the poisoned Microsoft VS Code extension reported by GitHub.
MITRE ATT&CK techniques used in TL-2026-0536
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1497 Virtualization/Sandbox Evasion
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
Execution
T1059 Command and Scripting Interpreter; T1129 Shared Modules; T1609 Container Administration Command; T1651 Cloud Administration Command
Command and Control
T1071 Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer; T1568 Dynamic Resolution
Discovery
T1083 File and Directory Discovery; T1580 Cloud Infrastructure Discovery; T1613 Container and Resource Discovery; T1614 System Location Discovery
Initial Access
T1195 Supply Chain Compromise; T1199 Trusted Relationship
Impact
T1485 Data Destruction; T1561 Disk Wipe; T1657 Financial Theft
Credential Access
T1528 Steal Application Access Token; T1552 Unsecured Credentials; T1555 Credentials from Password Stores
Persistence
T1546 Event Triggered Execution
Lateral Movement
T1550 Use Alternate Authentication Material
stealth
Resource Development
Affected products and versions in GitHub Internal Breach
- Microsoft — durabletask (PyPI)
Vulnerable versions: 1.4.1; 1.4.2; 1.4.3
Fixed in: <1.4.1 (pin); awaiting clean re-publish - GitHub (Microsoft) — GitHub internal source repositories
Vulnerable versions: ~3,800 internal repos exfiltrated
Fixed in: secret rotation completed; access revoked - Microsoft — Visual Studio Code (Marketplace extension)
Vulnerable versions: unspecified poisoned extension installed on GitHub employee device
Fixed in: pending publisher identification - TanStack — TanStack npm packages
Vulnerable versions: multiple compromised versions in May 2026 Mini Shai-Hulud wave
Fixed in: see Wiz/Snyk advisories - Various (172+ packages) — npm and PyPI packages
Vulnerable versions: 400+ malicious versions across 172 packages including Mistral AI, OpenSearch, Guardrails AI, UiPath
Fixed in: registry yanks in progress
Remediation for GitHub Internal Breach
Patches
- Use durabletask versions <1.4.1 until Microsoft re-publishes clean releases; verify via PyPI yank notices and Microsoft's official advisory
- Reinstall any package transitively pulling durabletask after rebuilding lockfiles
Immediate actions
- Block C2 indicators at perimeter: check.git-service.com, t.m-kosche.com, 83.142.209.194
- Inventory all hosts that installed durabletask versions 1.4.1, 1.4.2, or 1.4.3 since 2026-05-19
- Pin durabletask to last known-good version <1.4.1 in requirements/lockfiles
- Rotate AWS IAM keys, Azure service-account tokens, GCP tokens, HashiCorp Vault tokens, and 1Password/Bitwarden master passwords on any potentially exposed developer or CI host
- Hunt filesystem for /tmp/rope-*.pyz, /tmp/managed.pyz, ~/.cache/.sys-update-check, and ~/.cache/.sys-update-check-k8s
- Quarantine GitHub employee devices with unsanctioned VS Code extensions; audit Marketplace extension installs against allow-lists
Workarounds
- Air-gap or isolate Linux build agents that previously pulled the compromised wheels until forensic triage is complete
- Disable VS Code Marketplace auto-update during incident triage; manually verify extension publishers
Longer-term hardening
- Mandate package allow-lists and signed builds for internal Python/Node dependencies
- Deploy egress filtering and DNS RPZ for developer and CI/CD networks; treat outbound to *.git-service.com, *.m-kosche.com as high-risk
- Enforce least privilege on AWS SSM: restrict ssm:SendCommand to break-glass principals; alert on AWS-RunShellScript executions
- Restrict kubectl exec via Kubernetes RBAC and OPA/Kyverno policies; alert on exec from CI service accounts
- Adopt sigstore / PyPI Trusted Publishing and require 2FA + hardware tokens for all maintainer accounts of Microsoft-owned packages
- Add detections for FIRESCALE dead-drop pattern: outbound GitHub API or web traffic followed by C2 resolution to never-before-seen domains
- Deploy EDR with Linux behavioral telemetry on developer endpoints and build agents
Weaknesses (CWE) in GitHub Internal Breach
CWE-506, CWE-829, CWE-494, CWE-522
Timeline of GitHub Internal Breach
- TeamPCP launches original Shai-Hulud npm supply-chain worm using transformers.pyz payload; guardrails-ai is compromised in the same campaign.
- rope.pyz worm begins self-propagation via AWS SSM SendCommand (AWS-RunShellScript, up to 5 EC2 per profile) and kubectl exec from infected developer/CI hosts.
- Within ~5 hours, TeamPCP publishes 400+ malicious versions across 172 distinct npm and PyPI packages (TanStack, Mistral AI, OpenSearch, Guardrails AI, UiPath, durabletask, and others).
- TeamPCP publishes malicious durabletask 1.4.1, 1.4.2, and 1.4.3 to PyPI; loader injected into task.py, entities/__init__.py, extensions/__init__.py, and payload/__init__.py.
- Wiz, SafeDep, Aikido Security, StepSecurity, Endor Labs, Hunt.io, Snyk, Akamai, Expel, and Phoenix Security publish concurrent analyses of the Mini Shai-Hulud durabletask wave and the FIRESCALE dead-drop technique.
- X account xploitrsturtle2 publicly taunts GitHub: 'GitHub knew for hours, they delayed telling you and they won't be honest in the future.'
- GitHub states the activity 'involved exfiltration of GitHub-internal repositories only' and that '~3,800 repositories are directionally consistent with our investigation'; rotates critical secrets and prioritizes highest-impact credentials.
- TeamPCP lists ~4,000 GitHub-internal repositories for sale on cybercrime forum for a minimum of $50,000 with the message 'This is not a ransom...if no buyer is found, we leak it for free.'
- GitHub confirms breach of internal repositories; attributes initial access to a poisoned Microsoft Visual Studio Code extension on an employee device.
- As of 2026-05-29, this remains ACTIVE: PyPI yanked durabletask 1.4.1-1.4.3 and GitHub rotated secrets, but TeamPCP (UNC6780) is still at large with no arrest/takedown, and has now teamed with LAPSUS$ to sell the ~3,800 stolen repos for $95K. The self-propagating Mini Shai-Hulud worm, resilient FIRESCALE GitHub-commit C2, and copycat/rival (PCPJack) variants keep the campaign live.
Sources cited for GitHub Internal Breach
- GitHub Investigating TeamPCP-Claimed Breach — The Hacker News
- Mini Shai-Hulud Worm Compromises TanStack, Mistral AI, Guardrails AI & More Packages — The Hacker News
- TeamPCP Used Mini Shai-Hulud Worm to Poison Over 400 npm and PyPI Packages — Hackread
- Microsoft Python Client DurableTask Compromised by TeamPCP Hackers — Cybersecurity News
- Mini Shai-Hulud Strikes Again: TanStack + more npm Packages Compromised — Wiz
- TanStack npm Packages Hit by Mini Shai-Hulud — Snyk
- Mini Shai-Hulud Is Back: A Self-Spreading Supply Chain Attack — StepSecurity
- Mini Shai-Hulud: The Worm Returns and Goes Public — Akamai
- Mini Shai Hulud: Cross-ecosystem supply chain worm targeting npm & PyPI — Expel
- Mini Shai-Hulud Worm: 170+ npm & PyPI Packages Compromised — Qualys
- Sha1-Hulud / Shai-Hulud: Full Technical Dissection — Phoenix Security
Threats related to GitHub Internal Breach
- durabletask PyPI Supply Chain Compromise (v1.4.1–1.4.3) — Microsoft-Published Azure Durable Functions SDK Trojanized w/ Cross-Cloud Credential Stealer + Linux Disk Wiper (TeamPCP / Mini Shai-Hulud)
- Nx Console VS Code Extension Backdoored (v18.95.0) — TeamPCP Mini Shai-Hulud Pivot from TanStack npm Worm to GitHub Internal Repository Breach (CVE-2026-48027)
- TeamPCP @antv Supply Chain Wave — Mini Shai-Hulud Multi-Ecosystem npm/GitHub Actions/VSCode Compromise
- Backdoored Cemu v2.6 GitHub Release — TeamPCP Supply Chain Campaign Extends to Cemu Nintendo Wii U Emulator (cemu-project/Cemu)
- Mini Shai-Hulud v3 — TanStack/UiPath/Mistral AI npm & PyPI Supply Chain Compromise (TeamPCP)
- Shai-Hulud NPM Worm Compromises keyv, file-entry-cache, flat-cache and Hundreds of Popular npm Packages via Maintainer Account Takeover
Detection coverage for TL-2026-0536
As of 2026-05-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0536 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.