Full Report
AL26-013 Security incident impacting GitHub internal repositories
Analysis Summary
# Incident Report: GitHub Internal Repository Compromise (AL26-013)
## Executive Summary
On May 18, 2026, GitHub detected unauthorized access to its internal systems stemming from a supply-chain compromise of a developer tool. The attacker used a malicious version of the "Nx Console" VS Code extension to breach an employee device and exfiltrate approximately 3,800 internal repositories. GitHub has since rotated signing keys and advised customers of the GitHub Enterprise Server on necessary security updates.
## Incident Details
- **Discovery Date:** May 18, 2026
- **Incident Date:** May 11, 2026 – May 20, 2026 (Active window)
- **Affected Organization:** GitHub
- **Sector:** Technology / Software Development (SaaS)
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** Approximately May 11, 2026
- **Vector:** Supply-chain compromise of a third-party IDE extension.
- **Details:** A maliciously modified version of the Nx Console Visual Studio Code extension (v18.95.0) was installed on an employee device.
### Lateral Movement
- **Details:** The attacker used the compromised developer environment to pivot into GitHub’s internal infrastructure, leveraging the credentials and access levels associated with the infected workstation.
### Data Exfiltration/Impact
- **Details:** Approximately 3,800 internal GitHub repositories were exfiltrated. This included proprietary source code and internal configuration data.
### Detection & Response
- **Discovery:** Detected by GitHub internal monitoring on May 18, 2026.
- **Response actions taken:** Revocation of compromised credentials, rotation of GitHub Enterprise Server GPG signing keys, and public disclosure of the Nx Console compromise via security advisories (AV26-512).
## Attack Methodology
- **Initial Access:** Supply-chain compromise (Malicious VS Code extension).
- **Persistence:** Implementation of local persistence on macOS via launch agents.
- **Defense Evasion:** Use of a legitimate-looking developer extension update (Nx Console v18.95.0).
- **Credential Access:** Theft of credentials (AWS, GCP, Azure, GitHub, npm) stored or used on the developer's machine.
- **Discovery:** Automated scanning of local system files and internal network access.
- **Exfiltration:** Transfer of 3,800 internal source code repositories to attacker-controlled infrastructure.
- **Impact:** Theft of intellectual property and exposure of internal configurations.
## Impact Assessment
- **Financial:** Not disclosed; costs associated with incident response, key rotation, and potential IP loss.
- **Data Breach:** High; 3,800 internal repositories containing proprietary code.
- **Operational:** Disruption for GitHub Enterprise Server customers due to mandatory GPG key rotations.
- **Reputational:** High-profile breach of a leading security-conscious code hosting platform.
## Indicators of Compromise
- **File indicators:**
- `~/.local/share/kitty/cat.py` (Malicious Python script)
- **Behavioral indicators:**
- Unauthorized repository cloning or admin actions in CI/CD logs.
- Unexpected pushes or "orphan commits" from service accounts.
- Presence of Nx Console version 18.95.0.
## Response Actions
- **Containment:** Removal of the malicious Nx Console extension and isolation of the compromised device.
- **Eradication:** Rotation of all exposed cloud and registry credentials (AWS, GCP, Azure, npm).
- **Recovery:** Rotation of GitHub Enterprise Server GPG public keys; release of clean extension versions (18.96.0+).
## Lessons Learned
- **Key Takeaways:** Even highly secure organizations are vulnerable to supply-chain attacks targeting individual developer workstations through IDE extensions.
- **Gaps:** Relying on auto-updates for IDE extensions can bypass standard software vetting processes.
## Recommendations
- **Prevention:** Disable IDE extension auto-updates in high-security environments and enforce an "allowlist" of approved developer tools.
- **Hardening:** Implement strict monitoring of CI/CD logs for anomalous behavior from bot/service accounts.
- **Audit:** Regularly audit developer workstations for unauthorized launch agents and local persistence files.
- **Key Management:** Maintain a rapid-response plan for rotating GPG and code-signing keys across the enterprise.