--- title: "The GitHub Leak Situation Just Got Worse | Threat Wire" url: https://daily.dev/posts/the-github-leak-situation-just-got-worse-threat-wire-mnjtih6zl source_url: https://www.youtube.com/watch?v=PFD8FXxbM0U type: video:youtube source: "Hak5" published: 2026-05-28T13:17:56.476Z updated: 2026-05-28T13:18:17.408Z tags: ["cyber", "github", "cicd"] reading_time: 9 upvotes: 47 comments: 2 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The GitHub Leak Situation Just Got Worse | Threat Wire **[Hak5](https://daily.dev/sources/hak5)** · 9 min read · 47 upvotes · 2 comments ## Summary GitHub faced a severe week of security incidents attributed to threat actor Team PCP. The Megalodon campaign pushed 5,718 malicious commits across 5,561 repositories via compromised personal access tokens, stealing CI secrets, cloud credentials, SSH keys, OIDC tokens, and source code. Hudson Rock analysis found 33% of attacker usernames matched known info-stealer victims. Separately, a GitHub employee downloaded a malicious VS Code extension (NX Console, poisoned via the Tanstack compromise), leading to exfiltration of ~38,000 private internal repos and customer support data. Team PCP is selling the stolen GitHub source code for a minimum of $50,000, hinting at retirement. Additional stories include a CISA contractor's public GitHub repo exposing government credentials, Discord standardizing E2E encryption for calls, and OpenAI partnering with 1Password for AI coding agent credential management. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Community discussion Top comments from developers on daily.dev. **@darith** · 0 upvotes > "a GitHub employee downloaded a malicious VS Code extension (NX Console, poisoned via the Tanstack compromise), leading to exfiltration of ~38,000 private internal repos and customer support data" > > OUCH!!! **@mavros\_lykos** · 0 upvotes > Why Are You Github like this?.. very dissapointed --- Tags: [#cyber](https://daily.dev/tags/cyber), [#github](https://daily.dev/tags/github), [#cicd](https://daily.dev/tags/cicd) [View this post on daily.dev](https://daily.dev/posts/the-github-leak-situation-just-got-worse-threat-wire-mnjtih6zl)