TeamPCP Heist: Malicious VS Code Extension Breaches 3,800 GitHub Internal Repositories

Software supply-chain attacks have been brewing for decades—Ken Thompson warned in 1984 that trust in toolchains is exploitable, and the 2020 SolarWinds Orion backdoor showed a nation-state could ride that weakness into 18,000 networks. The TeamPCP caper fits the same pattern but with a twist: an inexpensive, almost fully automated worm spread through everyday developer plugins instead of a bespoke enterprise suite, echoing the mass infection tactics of 2016’s Mirai botnet more than SolarWinds’ stealth. It underscores two structural shifts: (1) development environments are now cloud-connected islands whose extensions run with full user privilege, and (2) credential reuse and AI-driven coding tools amplify the blast radius when one island falls. Whether this leak changes history depends on the secrets embedded in those internal repos, but the precedent matters: if the world’s largest code host cannot police its own extension marketplace, the next century of software may inherit a default-insecure supply chain—much the way the early Internet inherited SMTP without authentication and spent the following decades bolting on spam filters.