500 Poisoned Packages, Hundreds of Companies: TeamPCP's Worm Just Reached GitHub

Fuente: International Business Times

A GitHub employee installed a routine VS Code extension update on the morning of May 18, 2026. That single action handed cybercrime group TeamPCP enough access to exfiltrate approximately 3,800 of GitHub's internal source code repositories — everything from platform infrastructure to proprietary tooling built by the company that hosts more than 420 million repositories for over 180 million developers worldwide. GitHub confirmed the intrusion on May 20 and said it detected the compromise the previous day.