Poisoned VS Code extension leaks GitHub code

This incident highlights the extreme vulnerability of the developer supply chain, where even security-mature companies like GitHub can be hit by malicious IDE extensions.

• –The use of a "poisoned" VS Code extension as an entry point bypasses many traditional perimeter defenses.
• –3,800 repositories is a massive leak, likely including proprietary tooling and internal service logic.
• –The $50,000 asking price by TeamPCP suggests the attackers are looking for a quick payout rather than targeted long-term exploitation.
• –Rapid secret rotation is the right move, but the long-term risk of architectural knowledge leak remains high.
• –Developers should audit their own IDE extensions and consider stricter endpoint isolation for high-privilege accounts.