# GitHub Internal Breach — TeamPCP Exfiltrates 3,800+ Repos via Poisoned VS Code Extension Tied to Mini Shai-Hulud Worm

> Threat actor TeamPCP compromised a GitHub employee device via a poisoned Microsoft Visual Studio Code extension and exfiltrated approximately 3,800 GitHub-internal source repositories, which were subsequently listed for sale on a cybercrime forum for $50,000. The intrusion is tied to TeamPCP's concurrent Mini Shai-Hulud supply-chain worm campaign that poisoned Microsoft's official durabletask PyPI package (versions 1.4.1, 1.4.2, 1.4.3) and over 172 npm/PyPI packages with combined downloads exceeding 518 million. GitHub confirmed the breach scope and rotated critical secrets; the campaign represents one of the largest cross-ecosystem supply-chain compromises observed in 2026.

- **Published:** 2026-05-20T12:00:00Z
- **Last reviewed:** 2026-05-20T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0536
- **ID:** TL-2026-0536
- **Severity:** CRITICAL
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** TeamPCP
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On May 20, 2026, GitHub publicly confirmed that an unauthorized actor obtained access to internal-only GitHub repositories after threat actor TeamPCP began advertising approximately 4,000 repositories for sale on an underground forum for a minimum of $50,000. TeamPCP framed the offering as 'not a ransom' and warned that the data would be leaked freely if no buyer was found. An associated X account ('xploitrsturtle2') publicly taunted GitHub for delayed disclosure. GitHub's investigation found the attacker's claims 'directionally consistent' with the impact (~3,800 repositories) and attributed the initial access vector to a poisoned Microsoft Visual Studio Code extension installed on an employee device. GitHub stated the activity involved 'exfiltration of GitHub-internal repositories only' with no current evidence of customer data exposure.

The GitHub breach is operationally linked to TeamPCP's broader Mini Shai-Hulud campaign — a self-replicating supply-chain worm that is the direct evolutionary descendant of the original Shai-Hulud npm worm and the earlier transformers.pyz payload used in the guardrails-ai compromise. On May 19, 2026, the worm operators published trojanized versions 1.4.1, 1.4.2, and 1.4.3 of Microsoft's official durabletask Python SDK (the Python client for the Durable Task workflow framework, ~417,000 monthly downloads). Within approximately five hours, TeamPCP pushed over 400 malicious versions across 172 distinct packages spanning the npm and PyPI ecosystems, hitting major projects including TanStack, Mistral AI, OpenSearch, Guardrails AI, and UiPath.

The malicious durabletask wheel injects loader code into multiple entry points (task.py, entities/__init__.py, extensions/__init__.py, payload/__init__.py) so the implant runs the instant the package is imported, with no error messages or visible compromise. The loader fetches a 28KB Python ZIP application named rope.pyz from the C2 hosts check.git-service[.]com (primary) and t.m-kosche[.]com (fallback), with legacy infrastructure also resolving to 83.142.209.194. The dropper writes to /tmp/rope-*.pyz, executes as python3 /tmp/managed.pyz, and drops infection markers at ~/.cache/.sys-update-check (general) and ~/.cache/.sys-update-check-k8s (Kubernetes). The implant targets Linux exclusively.

rope.pyz is a Linux credential stealer with broad reach: it harvests AWS IAM credentials, Azure service-account tokens, and GCP service tokens; reads HashiCorp Vault KV secrets; unlocks and dumps 1Password and Bitwarden vaults (brute-forcing master passwords using harvested credential dictionaries when needed); enumerates pass/gopass stores; collects SSH private keys, Docker config credentials, VPN configurations, kubeconfig files, and shell history (.bash_history, .zsh_history). The worm then propagates two ways: (1) in AWS, after harvesting credentials, it enumerates SSM-managed instances and uses ssm:SendCommand with the AWS-RunShellScript document to execute rope.pyz on up to five other EC2 instances per profile; (2) in Kubernetes, it uses kubectl exec to drop and run the payload inside reachable pods, marking infected containers with the k8s-specific marker.

A novel component is FIRESCALE — a dead-drop resolver that searches GitHub's public commit-message corpus for the regex pattern 'FIRESCALE <base64_url>.<base64_signature>'. When primary C2 is blocked, the implant pulls operator-signed C2 addresses out of attacker-controlled commits, effectively turning GitHub itself into resilient C2 infrastructure that cannot easily be sinkholed at the DNS or IP layer. The campaign also includes a destructive overlay: when the implant detects an Israeli (he_IL) or Iranian (fa_IR) locale, there is a one-in-six chance it plays an audio file and then executes 'rm -rf /*', wiping the host. This ideological/destructive selector co-exists with the financially motivated repo-sale operation, leaving attribution motive mixed.

Defensive priorities: (1) audit all hosts that pulled durabletask 1.4.1-1.4.3 since May 19, 2026 and rotate ALL credentials reachable from those hosts (cloud, vault, password manager); (2) hunt for rope.pyz / managed.pyz file artifacts and the .sys-update-check markers; (3) block check.git-service.com, t.m-kosche.com, and 83.142.209.194 at the perimeter; (4) inspect AWS CloudTrail for ssm:SendCommand with AWS-RunShellScript invocations from unexpected principals; (5) inspect Kubernetes audit logs for kubectl exec from compromised service accounts; (6) hunt outbound HTTPS to api.github.com fetching commit messages with FIRESCALE patterns; (7) audit VS Code extensions installed on developer endpoints for the poisoned Microsoft VS Code extension reported by GitHub.

## MITRE ATT&CK

- T1586 Compromise Accounts
- T1583 Acquire Infrastructure
- T1195 Supply Chain Compromise
- T1199 Trusted Relationship
- T1059 Command and Scripting Interpreter
- T1129 Shared Modules
- T1651 Cloud Administration Command
- T1609 Container Administration Command
- T1546 Event Triggered Execution
- T1574 Hijack Execution Flow
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1497 Virtualization/Sandbox Evasion
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1528 Steal Application Access Token
- T1083 File and Directory Discovery
- T1580 Cloud Infrastructure Discovery
- T1613 Container and Resource Discovery
- T1614 System Location Discovery
- T1550 Use Alternate Authentication Material
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1102 Web Service
- T1568 Dynamic Resolution
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1485 Data Destruction
- T1561 Disk Wipe
- T1657 Financial Theft

## Sources

- [GitHub Investigating TeamPCP-Claimed Breach — The Hacker News](https://thehackernews.com/2026/05/github-investigating-teampcp-claimed.html)
- [Mini Shai-Hulud Worm Compromises TanStack, Mistral AI, Guardrails AI & More Packages — The Hacker News](https://thehackernews.com/2026/05/mini-shai-hulud-worm-compromises.html)
- [TeamPCP Used Mini Shai-Hulud Worm to Poison Over 400 npm and PyPI Packages — Hackread](https://hackread.com/teampcp-mini-shai-hulud-worm-npm-pypi-packages/)
- [Microsoft Python Client DurableTask Compromised by TeamPCP Hackers — Cybersecurity News](https://cybersecuritynews.com/microsoft-python-client-durabletask/)
- [Mini Shai-Hulud Strikes Again: TanStack + more npm Packages Compromised — Wiz](https://www.wiz.io/blog/mini-shai-hulud-strikes-again-tanstack-more-npm-packages-compromised)
- [TanStack npm Packages Hit by Mini Shai-Hulud — Snyk](https://snyk.io/blog/tanstack-npm-packages-compromised/)
- [Mini Shai-Hulud Is Back: A Self-Spreading Supply Chain Attack — StepSecurity](https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem)
- [Mini Shai-Hulud: The Worm Returns and Goes Public — Akamai](https://www.akamai.com/blog/security-research/mini-shai-hulud-worm-returns-goes-public)
- [Mini Shai Hulud: Cross-ecosystem supply chain worm targeting npm & PyPI — Expel](https://expel.com/blog/mini-shai-hulud-cross-ecosystem-supply-chain-worm-targeting-npm-pypi/)
- [Mini Shai-Hulud Worm: 170+ npm & PyPI Packages Compromised — Qualys](https://qualysec.com/cybersecurity-news/mini-shai-hulud-worm-compromises/)
- [Sha1-Hulud / Shai-Hulud: Full Technical Dissection — Phoenix Security](https://phoenix.security/sha1-hulud-shai-hulud-worm-analysis-persistence-iocs/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0536