{"id":979,"date":"2026-05-20T04:35:04","date_gmt":"2026-05-20T04:35:04","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=979"},"modified":"2026-05-20T04:35:04","modified_gmt":"2026-05-20T04:35:04","slug":"github-investigating-teampcp-claimed-breach-of-4000-internal-repositories","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=979","title":{"rendered":"GitHub Investigating TeamPCP Claimed Breach of ~4,000 Internal Repositories"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>May 20, 2026<\/span><\/span>Malware \/ Cloud Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

GitHub on Tuesday said it’s investigating unauthorized access to its internal repositories after the notorious threat actor known as TeamPCP listed the platform’s source code and internal organizations for sale on a cybercrime forum.<\/p>\n

\u00abWhile we currently have no evidence of impact to customer information stored outside of GitHub’s internal repositories (such as our customers’ enterprises, organizations, and repositories), we are closely monitoring our infrastructure for follow-on activity,\u00bb the Microsoft-owned subsidiary said<\/a>.<\/p>\n

The company also noted that it will notify customers via established incident response and notification channels if any impact is discovered.<\/p>\n

The development comes after TeamPCP, a threat actor behind a string of software supply chain attacks targeting open-source packages, listed GitHub’s source code for sale for an asking price of no less than $50,000. The alleged data dump is said to include about 4,000 repositories.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

\u00abAs always, this is not a ransom,\u00bb the group said in a post, according to screenshots<\/a> shared by Dark Web Informer. \u00abWe do not care about extorting GitHub, 1 buyer and we shred the data on our end, it looks like our retirement is soon so if no buyer is found, we leak it for free.\u00bb<\/p>\n

TeamPCP Compromises durabletask PyPI Package<\/h3>\n

News of the sale comes as TeamPCP’s self-replicating malware campaign, known as Mini Shai-Hulud, continues to expand in reach with the compromise of durabletask, an official Microsoft Python client for the Durable Task workflow execution framework. Three malicious package versions have been identified: 1.4.1, 1.4.2, and 1.4.3.<\/p>\n

\u00abThe attacker compromised a GitHub account via a previous attack, dumped GitHub secrets from a repository to which the user had access, and from there had access to the PyPi token to publish directly,\u00bb Google-owned Wiz said<\/a>.<\/p>\n

The payload embedded into the package is a dropper, which is configured to fetch and run a second-stage payload (\u00abrope.pyz\u00bb) from an external server (\u00abcheck.git-service[.]com\u00bb). The malware is assessed to be an evolution of the payload deployed in connection with the compromise of the guardrails-ai package last week.<\/p>\n

\"\"<\/a><\/div>\n

Specifically, it’s designed to activate a full-featured infostealer that’s capable of harvesting credentials associated with major cloud providers, password managers, and developer tools, and exfiltrating the data to the attacker-controlled domain. It’s worth noting that the stealer is configured to execute only on Linux systems.<\/p>\n

According to SafeDep<\/a>, the 28KB Python stealer also attempts to read HashiCorp Vault KV secrets, unlock and dump 1Password and Bitwarden password vaults, and access SSH keys, Docker credentials, VPN configurations, and shell history.<\/p>\n

\u00abIf the machine is running inside AWS, it propagates itself to other EC2 instances using SSM. If it’s inside Kubernetes, it propagates through kubectl exec,\u00bb Aikido Security said<\/a>. \u00abAnd if it detects Israeli or Iranian system settings, there’s a 1-in-6 chance it plays audio and then runs rm -rf \/*.\u00bb<\/p>\n

\u00abAfter enumerating SSM-managed instances, it uses SendCommand with the AWS-RunShellScript document to execute the rope.pyz payload on up to 5 other EC2 instances per profile,\u00bb per StepSecurity<\/a>. \u00abThe propagation script downloads the payload from the primary C2, falling back to the secondary domain t.m-kosche[.]com, and runs it in the background.\u00bb<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Also notable is the use of the FIRESCALE mechanism to identify a backup command-and-control (C2) address in the event the primary domain is unreachable. It does this by searching GitHub’s public commit messages for the pattern \u00abFIRESCALE .\u00bb and extracting the C2 information from it. Details of this technique were previously highlighted by Hunt.io.<\/base64_signatue><\/base64_url><\/p>\n

Because the worm propagates using tokens stolen from infected environments, the number of affected packages is expected to grow. Any machine or pipeline that installed an affected version of the package should be treated as fully compromised.<\/p>\n

\u00abThe package is downloaded roughly 417,000 times a month, and the malicious code runs automatically the moment the package is imported, with no error messages and no visible signs of compromise,\u00bb Endor Labs researcher Peyton Kennedy said<\/a>.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

\ue804Ravie Lakshmanan\ue802May 20, 2026Malware \/ Cloud Security GitHub on Tuesday said it’s investigating unauthorized access to its internal repositories after the notorious threat actor known as TeamPCP listed the platform’s…<\/p>\n","protected":false},"author":1,"featured_media":980,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[278,1736,71,1737,663,1738,855],"class_list":["post-979","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-breach","tag-claimed","tag-github","tag-internal","tag-investigating","tag-repositories","tag-teampcp"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/979","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=979"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/979\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/980"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=979"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=979"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=979"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}