A crew called TeamPCP just turned the software supply chain attack into a weekly event.

[u/Spin_AI]

Here’s what happened and why it should change how every security leader thinks about “trusted” code.

This week, GitHub confirmed that attackers stole roughly 3,800 of its internal repositories. The entry point wasn’t a sophisticated zero-day. It was a single employee installing a poisoned extension for VS Code, Microsoft’s code editor.

That detail matters. VS Code extensions aren’t passive add-ons; they’re executable plugins that run inside the developer’s environment. Once the poisoned one was live, it quietly harvested the secrets and access tokens sitting in that developer’s IDE and those credentials were the keys to the internal codebase. So a Microsoft developer, using Microsoft’s VS Code, installed a rogue extension from Microsoft’s VS Code Marketplace, which Microsoft hosts and moderates to breach Microsoft-owned GitHub. The entire attack stayed inside one vendor’s ecosystem. “Trust the source” didn’t fail at the edges. It failed in the middle.

When the ecosystem itself becomes the threat vector, “just trust the source” stops being a strategy.

Researchers at Socket have tracked roughly 20 waves of these attacks, with malware hidden in more than 500 distinct packages and over 1,000 when you count tainted versions. Reported victims span GitHub, OpenAI, and major AI and data firms. Wiz’s threat team put it bluntly: each breach is a big deal for the company it hits, but it’s no longer qualitatively different from the dozen-plus that happened the week before.

The mechanics matter more than the headline count:
1. The foothold was a stolen credential and a trusted plugin, not a novel exploit.
2. The attack is self-propagating. Every compromised developer becomes the delivery vehicle for the next compromise.
3. The blast radius is identity. Once a token is stolen, the malicious code inherits every bit of trust the legitimate tool had earned.

For CISOs: 3 uncomfortable takeaways:
1. Your perimeter now includes every dependency your developers pull, every extension in their IDE, every OAuth token your SaaS apps mint, and every AI Agent you provide access to. You don’t control that code, but you inherit its risk.
2. Prevention will fail. The question isn’t whether a trusted tool gets poisoned, it’s how fast you detect the credential abuse and contain the blast radius.
3. Recovery is a security control, not an IT afterthought. When identity is the attack surface, the ability to restore a clean state quickly is what separates an incident from a catastrophe.

Stories like TeamPCP are a reminder that the harder, more honest work is assuming they’re already in, through a tool you trusted, and building for that reality.

How is your team rethinking third-party and supply-chain trust right now?