GitHub Confirms 3,800 Repos Exfiltrated via Poisoned VS Code Extension, MSFT at $416.78

GitHub has confirmed that roughly 3,800 internal repositories were stolen after a malicious Visual Studio Code extension compromised an employee device. Threat actor TeamPCP claimed responsibility and listed the data for sale, demanding at least $50,000. The company responded by rotating critical credentials, isolating the endpoint, and stated that no customer data was impacted. The incident follows a similar supply-chain attack at Grafana Labs and has prompted broader calls for tighter developer security. Microsoft shares fell 1.44% to $417.42 in regular trading and slipped further to $416.78 in after-hours.