Post

1/ We are sharing additional details regarding our investigation into unauthorized access to GitHub's internal repositories.

2/ On Monday, we detected and contained a compromise of an employee device involving a poisoned VS Code extension. We removed the malicious extension version, isolated the endpoint, and began incident response immediately.

4/ We moved quickly to reduce risk. Critical secrets were rotated on Monday and into Tuesday with the highest-impact credentials prioritized first.

5/ We continue to analyze logs, validate secret rotation, and monitor for any follow-on activity. We will take additional action as the investigation warrants.