A single bad plugin just gave hackers a back-door pass into one of the most key parts of tech online.
GitHub is the code-sharing site Microsoft owns. It said hackers walked off with data from about 3,800 of its in-house code repos.
The firm shared the news in a series of posts on X. The probe is still going.
GitHub said the hack began with a "poisoned" VS Code plugin on one worker's PC. VS Code is Microsoft's well-used code editor.
Plugins are small add-ons that bring new tools to apps. They are now a top hacker target.
One bad plugin can quietly hit thousands of devices at once.
GitHub did not name the bad plugin. It said no user data outside its in-house repos appears to have been touched.
For scale: GitHub hosts code for millions of coders and most of the world's open-source work.
Microsoft bought the site in 2018 for $7.5 billion.
We break down stories like this in plain words in Market Briefs - sent each weekday morning, with a free investing class when you sign up.
A group called TeamPCP has taken credit, with reports from The Record and Bleeping Computer.
The group is now selling the stolen data on a cyber crime forum.
This is not their first big hit. TeamPCP took more than 90 gigs of data from the European Commission last time.
They got in by first breaking into Trivy, a small tool used to scan for bugs.
OpenAI was hit in a like-style attack on Tanstack, a small site used by web coders.
The pattern is plain: hackers go after small tools that coders trust, then ride those tools into much bigger firms.
These "supply chain" hacks have spiked of late. One bad tool can hit thousands of users at once.
The big question is what was inside the stolen repos.
In-house code can hold keys, security info, and unreleased product plans that hackers can resell or use to break into more firms.
For Microsoft investors, the timing stings. The firm sells itself as a top name in tech safety.
A hack of its own coder site is not a great look.
The broader risk is supply chain. If one bad plugin can hit GitHub, the same trick can hit other big sites.
That puts more weight on tech safety firms that scan for these threats.
Stocks in that space could see fresh buyer interest.
Hackers keep targeting the small tools that big firms rely on. Each new hack adds to the case for more spend on safety.
Microsoft and GitHub have not said yet if anything big was leaked. Until they do, the safer bet is that this story is not done.
More details from the probe could land in the days ahead.
If you want to stay on top of news like this and what it means for tech stocks, join Market Briefs - the daily wrap comes with a 45-minute investing course thrown in for free.
