GitHub just lost 3,800 repos to a VS Code extension

GitHub got hit. Was it a sophisticated zero-day? or a server-side exploit? Nope... one developer installed one extension, and now 3,800 internal repositories are for sale on a forum.

The group calling themselves TeamPCP is asking $50,000 for the haul. They got in through a poisoned VS Code extension on an employee's machine. Attackers scraped local session tokens and cloned thousands of repos before anyone noticed the spike. GitHub claims customer data is safe for now. They're still investigating.

This is the third major supply-chain event in six weeks. First came GhostAction, then Nx s1ngularity, followed by the Shai-Hulud npm worm. There is clearly a trend forming here... Attackers aren't wasting time on platform security. They're going for access to your laptop instead. We spent a decade hardening so called production measures while unknowingly leaving our IDEs wide open.

Securing the developer machine

Don't wait for the post-mortem to arrive in your inbox. Assume the tools you use every day are compromised.

Audit your VS Code extensions. Attackers buy popular abandoned extensions and push malicious updates. Open your extensions list and delete anything you haven't used this month.

Rotate your Personal Access Tokens. PATs often sit in your

.bash_history

.env

Switch to fine-grained tokens. Broad-scope tokens give an attacker keys to every repo you touch. Fine-grained tokens let you limit access to a single repository with a 30-day expiry.

Enable hardware 2FA. SMS and app-based codes are easy to hijack through SIM swaps or session theft. Use a YubiKey or your laptop's built-in passkey.

Audit workflows for

pull_request_target

.github/workflows/

Pin Actions to a commit SHA. Using

@v3

Lock down the main branch. Require signed commits and at least one approved review. Block direct pushes. This prevents a stolen token from pushing code to production without eyes on it.

Turn on Secret Scanning. Push protection stops you from leaking keys before they hit the server. It takes one click in the repository settings and costs nothing.

The self-hosted escape hatch

If your code is worth money, it doesn't belong on a platform that just lost 3,800 of its own repos. Self-hosting removes you from the global target list.

Forgejo is the current best pick. It's a community-driven fork of Gitea that stays lightweight and focused. Gitea is the original, but governance has been messy since 2022. GitLab CE has every feature you'd want but needs the RAM to match — overkill for most teams.

A $5 VPS with 2GB of RAM is enough for a small team. Setup takes fifteen minutes with Docker.

services:
  forgejo:
    image: codeberg.org/forgejo/forgejo:8
    container_name: forgejo
    environment:
      - USER_UID=1000
      - USER_GID=1000
    restart: always
    volumes:
      - ./data:/data
    ports:
      - "2222:22"

  caddy:
    image: caddy:latest
    restart: always
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
      - caddy_data:/data
    depends_on:
      - forgejo

volumes:
  caddy_data:

Your

Caddyfile

git.yourdomain.com {
  reverse_proxy forgejo:3000
}

Point a DNS A-record at the VPS,

docker compose up -d

Backups are the only real work. Set up a cron job to tar your data directory and push it to an S3-compatible bucket.

Move the code that matters

Public open-source projects can stay on GitHub. That code is already public, and that's where the contributors are.

Everything else needs to move. If you wouldn't want your private repos sold on a forum for $50k, stop hosting them on a platform that can't protect its own. Fifteen minutes of setup and you're the one holding the keys.

Need help auditing your repo security or setting up a self-hosted Forgejo instance for your team? Get in touch.