Top
Best
New

Posted by Timofeibu 9 hours ago

GitHub confirms breach of 3,800 repos via malicious VSCode extension(www.bleepingcomputer.com)
Previous thread in sequence:

GitHub is investigating unauthorized access to their internal repositories - https://news.ycombinator.com/item?id=48201316 - May 2026 (321 comments)

421 points | 136 comments
psadauskas 2 hours ago|
If only the company behind VSCode, the company behind NPM and the company behind GitHub could get together and figure out a solution to this.
lacker 1 hour ago||
Perfectly demonstrating the truth of the "Microsoft org chart" cartoon.

https://bonkersworld.net/organizational-charts

ozim 1 hour ago|||
It is also company behind NuGet.

Guess what they did a year ago.

They removed 700 or so packages from NuGet proactively but those turned out to be false positives.

It is hard to do the right things.

notnmeyer 2 hours ago|||
i mean, then you say it like that…
midtake 1 hour ago||
Microsoft is the inverse hand of Midas, turns everything into shit.
loloquwowndueo 1 minute ago|||
Everything Microsoft makes sucks. If they decided to make vacuum cleaners though, they wouldn’t suck, they would blow.
dbalatero 1 hour ago||||
Mierdas, as they say.
pixl97 1 hour ago||||
With $101 billion in profit last year I wish I could turn things into $hit as well as they do.
bhadass 1 hour ago|||
these days it's just Microslop
sieabahlpark 25 minutes ago||
[dead]
mcoliver 1 hour ago||
Vs code extensions have been terrifying for a long time. Such a wild and obvious attack vector. I'm constantly getting pop ups in vscode to install an extension because it recognizes a certain file type. It's 50-50 whether that extension is owned by a company or some random dev. Some of these have millions of installs and on first glance appear to be official company owned extensions. I'm at a point in my life where I only installed official company owned extensions and even that is hard to be sure I'm not getting suckered. Sad state.
Gigachad 10 minutes ago|
The problem extends far beyond VS code. All extensions and executable code has the same problem. There was a case where Disney was hacked because an employee installed a BeamNG mod that had bundled malware.

A company that wants to remain secure would have to employ strict restrictions on installing software. Only installing npm packages and plugins from an internal preapproved repo for example.

QuantumNoodle 1 hour ago||
I'm more surprised hackers found enough of a window of uptime to do this.
hungryhobbit 54 minutes ago|
For those not getting the joke, GitHub has had an increasingly difficult keeping itself up since Microsoft acquired them.

It's gotten a lot worse (and made news) more recently, as the downtime as increased.

pathartl 46 minutes ago||
No, it's had an increasingly difficult time keeping itself ever since they fixed their uptime metric collection, added Actions, and exploded in users.
dang 4 hours ago||
Previous thread in sequence:

GitHub is investigating unauthorized access to their internal repositories - https://news.ycombinator.com/item?id=48201316 - May 2026 (321 comments)

notnullorvoid 3 hours ago||
I really hope this pushes Microsoft to add a explicit permission system to VS Code extensions, and improve security of dev containers.
pamcake 1 hour ago||
I really hope this pushes users (here: devs and maintainers) to decrease their reliance on Microsoft and especially stop outsourcing security to them.

Migrate off vscode already.

Gigachad 9 minutes ago|||
The problem is not VS code itself. It's the fact extensions can access things outside of the editor. As far as I am aware, no editor sandboxes extensions.
hungryhobbit 48 minutes ago||||
I won't say "you can take my VS Code from cold dead hands" or anything, but it is a very good tool, and Microsoft hasn't yet fucked it up the way they have so many other things.

I guess I'd say "you take my VS Code ... willingly ... but only after M$ fucks it up and makes me not want it anymore (like they've done to everything else they acquired)".

sieabahlpark 18 minutes ago||
[dead]
notnullorvoid 1 hour ago||||
> Migrate off vscode already.

Zed is the closest thing I've found to meet my needs, and I do plan to try it. However it's dev container support looks to be lacking in some important ways so we'll see.

spudlyo 6 minutes ago||||
Emacs has been a viable option for going on a half century now. The GNU Emacs 31 branch[0] was cut recently and we're barreling towards a new release. It might be time to give it another look. I'm not saying its package ecosystem is not vulnerable to these kind of attacks, it is, but it is at least developed by a community of hackers who have very different goals and ambitions than Microsoft.

[0]: https://github.com/emacs-mirror/emacs/blob/master/etc/NEWS

ajross 39 minutes ago|||
> Migrate off vscode already.

It's not the IDE, though. Any extensible, customizable display editor can be coerced into behaving badly by installing external code. Even this one: https://www.gnu.org/software/emacs/emacs-paper.html

The root(-ish) cause here is the ease of publishing and installing extension code, and in particular the fact that there's no independent validation/verification step between the upstream author and armageddon. And upstream authors aren't set up with the needed precautions themselves, they're just hackers.

Basically if you phish Just One Account with write access to an extension you wan pwn everyone who's running it.

fg137 3 hours ago||
Not holding my breath. This issue has been open since 2018 https://github.com/microsoft/vscode/issues/52116
notnullorvoid 2 hours ago||
Yeah, the only thing that gives me hope is the optics of this happening to GitHub. Though it seems possible VS Code team could double down on the opinion that this isn't a permission/sandboxing problem, and is instead a scanning/threat detection problem.
urbandw311er 1 hour ago||
I wonder if this was the compromised nx console extension that bit me yesterday. The timing seems identical. See https://github.com/nrwl/nx-console/security/advisories/GHSA-...
K3UL 1 hour ago|
GitHub confirmed that it's indeed the nx console extension, in their blog post: https://github.blog/security/investigating-unauthorized-acce...
huey77 8 minutes ago||
The forum listing for the stolen source code (per the screenshot in article) says 1 buyer or they leak for free. Is GitHub about to become open source?
codedokode 3 hours ago||
Note that VS Code is built on Electron and it is a pain to sandbox because Electron has (had?) SUID sandbox helper, and you cannot run SUID binaries in sandbox easily. Sandboxing on Linux is extremely difficult task.
jandrese 3 hours ago||
It feels so bad to see the "You need go give Chrome SUID Root for the sandbox to work". Setting a Web Browser SUID Root was an old joke about clueless users. It was the worst security screwup someone could imagine.
NewJazz 1 hour ago|||
Don't build your ide on electron then.
duped 3 hours ago||
podman seems to handle rootless namespaces just fine, minor caveat for some perf overhead but it's not the end of the world.
internet101010 2 hours ago||
And volumes. Volumes are not fun with podman. Ironically my team tried GitHub Codespaces and never looked back. Super cheap and uses DevContainers.
unethical_ban 1 hour ago||
What's the difference between Podman and docker for volumes? Other than needing to add Z to get volumes to mount with SELinux
cdrnsf 2 hours ago||
That's one way to make things open source.
tekacs 3 hours ago|
Maybe I'm missing something really obvious, but... 3,800 repos? I guess I find it kind of surprising they have that many!
PAndreew 3 hours ago||
As others have said it's just a fraction. I'm in a medium size tech-related company and we have 7500+ in one Github org. We have two orgs, so altogether easily 10K+. Of course most of it is stale, obsolete, sandbox, personal tools, etc. I wouldn't be surprised if Github would have 100K+ internal repos or even more.
htrp 2 hours ago||
no pruning of repos?
sbarre 2 hours ago|||
No OP but I used to work at a large company with a similar number of repos.

When I left about a year ago, we had just started (after being on Github for almost 8 years) an ongoing project of first archiving old/outdated repos in place, and then moving them to an "archived" sub-org, and waiting to see if anyone complained.

Previously no one wanted to outright delete or remove repos because of the risk that someone somewhere was relying on it, and also there was no actual downside to just leaving them there (no cost savings, no imminent danger other than clutter, etc), so resources were never allocated to do it. There was always something more important to work on.

In an org with a higher floor of engineering management, a proactive program for removing unused or outdated repos would absolutely be expected though I think.

a_t48 40 minutes ago||
This is a continual fight for me. At nearly every company I've had to compromise on using a graveyard repo for packages within a monorepo, even though git has the whole history already.
NewJazz 1 hour ago||||
Gitlab is so nice for this. You can group repos together so it is harder to lose track of stale projects.
fn-mote 1 hour ago|||
Breaks old stuff
ashishb 2 hours ago|||
Uber had 8000 repos at one point with 2000 engineers - https://highscalability.com/lessons-learned-from-scaling-ube...
Gigachad 7 minutes ago||
Probably most of them are forks of some public repo with some patch applied and half of those are probably not even used internally anymore.
philipp-gayret 2 hours ago|||
I worked for a food retail store once. I remember going in the first day wondering, how hard can it really be... From the outside, it looks like they have a simple website. The website to order things on was an amalgamation of 300+ repo's. GitHub lost less in this breach. It takes a lot of effort to keep things simple as you grow.
robotnikman 1 hour ago||
Can confirm as someone working in the same field, we have a ton of repos
ryanhecht 1 hour ago|||
Something cool that I've always liked about working at GitHub is how much of the company _runs on GitHub_ -- A lot of teams, even non-technical teams, have their own repos just to organize docs/SOP's/designs/etc like a traditional knowledge work company might use a Sharepoint
tempay 3 hours ago|||
Personally I have over a hundred, especially from quick prototypes, studies or instances of templates so I can easily see how over 18 years and many hundreds of employees you end up with thousands.
MrDarcy 3 hours ago|||
3800 is low for an org like GitHub. Glad it’s highly likely not all their repos are compromised.
organsnyder 3 hours ago||
Given the attack vector, it's possible that the impacted repos were ones that see more activity.
dgellow 3 hours ago|||
I was part of an org with more than 15k repos
newsoftheday 3 hours ago|||
It sounds low to me, I worked at a Fortune high number a few years ago and they had more.
noelsusman 3 hours ago|||
Am I missing the joke here... they have hundreds of millions of repos.
dijit 3 hours ago|||
I think they mean that these are internal github-org repos.

The ones used for running the site itself.

Though, its so many that i think there are some customer ones in there too.

nightpool 3 hours ago||||
No, there's no joke, you might have just misread the article (the 3,800 number is the number of internal GitHub repos the employee had downloaded on their personal computer / had access to on their own GitHub account)
Galanwe 3 hours ago|||
The breach is about internal repositories, not user repositories.
skissane 2 hours ago|||
In my personal experience, give it a decade or two, and any corporation will accumulate hundreds (or even thousands) of abandoned internal repos containing discontinued services, POCs/prototypes that never went anywhere, etc – people forget to archive them, or aren't sure whether something is still in use or not so err on the safe side.

AI is making this even worse. With coding agents, anyone can throw together a quick internal prototype of any idea they have, even if it has no hope of ever making it to production.

unix4ever 2 hours ago||
Maybe though AI will make it better, assign agents to monitor, maintain and keep repos up to date or via A2A refer them to an agent to dispose of them in accordance with company requirements. I actually think AI will greatly help this type of problem.
skissane 1 hour ago||
Autoarchiving repos which nobody has used in X years doesn’t require any AI - you can just write a bot to do it. People don’t, because it isn’t a priority. AI can make writing such a bot a bit easier, but can’t help much with getting approval from the powers that be to run it.
eddythompson80 3 hours ago|||
really? I mean these are internal repos. Probably most of them are random one-off experiments or a place to park code. Google has 2,900 "public" repos on github. Microsoft has ~8k "public" on github too. Can't even imagine how many they have on their internal systems.
paulddraper 3 hours ago||
They have 800 engineers. So 3,800 repos is high, but not crazy.

Some of those could be forks.

More comments...