GitHub Internal Breach — TeamPCP Exfiltrates 3,800+ Repos via Poisoned VS Code Extension Tied to Mini Shai-Hulud Worm — Threadlinqs Intelligence
As of 2026-05-30, GitHub Internal Breach — TeamPCP Exfiltrates 3,800+ Repos via Poisoned VS Code Extension Tied to Mini Shai-Hulud Worm is a critical-severity supply chain threat attributed to TeamPCP, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 26 indicators of compromise.
Threat ID: TL-2026-0536 · Severity: CRITICAL · Status: ACTIVE · Category: SUPPLY_CHAIN
Attribution: TeamPCP · FINANCIAL
Threat actor TeamPCP compromised a GitHub employee device via a poisoned Microsoft Visual Studio Code extension and exfiltrated approximately 3,800 GitHub-internal source repositories, which were
On May 20, 2026, GitHub publicly confirmed that an unauthorized actor obtained access to internal-only GitHub repositories after threat actor TeamPCP began advertising approximately 4,000 repositories for sale on an underground forum for a minimum of $50,000. TeamPCP framed the offering as 'not a ransom' and warned that the data would be leaked freely if no buyer was found. An associated X account ('xploitrsturtle2') publicly taunted GitHub for delayed disclosure. GitHub's investigation found the attacker's claims 'directionally consistent' with the impact (~3,800 repositories) and attributed the initial access vector to a poisoned Microsoft Visual Studio Code extension installed on an employee device. GitHub stated the activity involved 'exfiltration of GitHub-internal repositories only' with no current evidence of customer data exposure.
The GitHub breach is operationally linked to TeamPCP's broader Mini Shai-Hulud campaign — a self-replicating supply-chain worm that is the direct evolutionary descendant of the original Shai-Hulud npm worm and the earlier transformers.pyz payload used in the guardrails-ai compromise. On May 19, 2026, the worm operators published trojanized versions 1.4.1, 1.4.2, and 1.4.3 of Microsoft's official durabletask Python SDK (the Python client for the Durable Task workflow framework, ~417,000 monthly downloads). Within approximately five hours, TeamPCP pushed over 400 malicious versions across 172 distinct packages spanning the npm and PyPI ecosystems, hitting major projects including TanStack, Mistral AI, OpenSearch, Guardrails AI, and UiPath.
The malicious durabletask wheel injects loader code into multiple entry points (task.py, entities/__init__.py, extensions/__init__.py, payload/__init__.py) so the implant runs the instant the package is imported, with no error messages or visible compromise. The loader fetches a 28KB Python ZIP application named rope.pyz from the C2 hosts check.git-service[.]com (primary) and t.m-kosche[.]com (fallback), with legacy infrastructure also resolving to 83.142.209.194. The dropper writes to /tmp/rope-*.pyz, executes as python3 /tmp/managed.pyz, and drops infection markers at ~/.cache/.sys-update-check (general) and ~/.cache/.sys-update-check-k8s (Kubernetes). The implant targets Linux exclusively.
rope.pyz is a Linux credential stealer with broad reach: it harvests AWS IAM credentials, Azure service-account tokens, and GCP service tokens; reads HashiCorp Vault KV secrets; unlocks and dumps 1Password and Bitwarden vaults (brute-forcing master passwords using harvested credential dictionaries when needed); enumerates pass/gopass stores; collects SSH private keys, Docker config credentials, VPN configurations, kubeconfig files, and shell history (.bash_history, .zsh_history). The worm then propagates two ways: (1) in AWS, after harvesting credentials, it enumerates SSM-managed instances and uses ssm:SendCommand with the AWS-RunShellScript document to execute rope.pyz on up to five other EC2 instances per profile; (2) in Kubernetes, it uses kubectl exec to drop and run the payload inside reachable pods, marking infected containers with the k8s-specific marker.
A novel component is FIRESCALE — a dead-drop resolver that searches GitHub's public commit-message corpus for the regex pattern 'FIRESCALE <base64_url>.<base64_signature>'. When primary C2 is blocked, the implant pulls operator-signed C2 addresses out of attacker-controlled commits, effectively turning GitHub itself into resilient C2 infrastructure that cannot easily be sinkholed at the DNS or IP layer. The campaign also includes a destructive overlay: when the implant detects an Israeli (he_IL) or Iranian (fa_IR) locale, there is a one-in-six chance it plays an audio file and then executes 'rm -rf /*', wiping the host. This ideological/destructive selector co-exists with the financially motivated repo-sale operation, leaving attribution motive mixed.
Defensive priorities: (1) audit all hosts that pulled d
Weaknesses (CWE)
CWE-506, CWE-829, CWE-494, CWE-522
Target sectors: technology, software-development, cloud-services, open-source-ecosystem, ci-cd-infrastructure, financial-services, government
Target regions: Global, North America, Europe, Asia-Pacific, Middle East (destructive overlay targets Israeli and Iranian locales)
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 26 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, T1586, T1583, T1195, T1195, T1199, T1059, T1129, T1651, T1609, T1546