Post

Today in tech news: Microsoft’s GitHub was compromised when a Microsoft developer (working on Microsoft GitHub internals) using Microsoft VSCode installed malware via Microsoft’s VSCode extension library, which is moderated and hosted by Microsoft.

20/5/26, 9:03 am8 reposts24 likes

Rusmumrikken 🏳️‍🌈

@rusmumrikken.bsky.social

25 May

And the extension was hacked because of a malicious package on npm, which is also hosted and owned by Microsoft.

Nicolás Alvarez

@nicolas17.xyz

25 May

Wasn't the npm package compromised via GitHub Actions? Which... yeah.

Mara 🕊️

@codero.be

20 May

Microsoft then (as GitHub) posted about the incident, failing to name the poisoned extension by name, ensuring that follow up security audits is made as hard as possible for third parties. Github (operated by Microsoft) confirmed that 3800 private repos got leaked. Open source at last.

Rick Crawford

@rickcrawf.bsky.social

25 May

Do we know how many private repos there are on GitHub? I am guessing it is more than 3800.