On May 18, 2026, threat actor TeamPCP compromised a GitHub employee device via a malicious Visual Studio Code extension, exfiltrating approximately 3,800 internal repositories containing source code for GitHub Actions, Copilot, CodeQL, Codespaces, Dependabot, and internal infrastructure. Internal repositories are suspected to contain customer support data, though the full scope of exposure has not been verified by GitHub. This breach exposes proprietary development tooling and AI-assisted coding infrastructure to a threat actor actively conducting broader supply chain operations, creating downstream risk for the millions of developers and enterprises that depend on GitHub’s platform integrity.