May 19, 2026
Push to panic
GitHub Compromised
GitHub says one bad add-on poisoned a worker’s laptop, but commenters are obsessed with the 3,800 secret repos
TLDR: GitHub says a malicious coding add-on infected an employee laptop and gave attackers access to internal repositories, which matters because it exposed how much damage one compromised device might cause. Commenters are split between disbelief over the reported 3,800 repos and grim nods that loose internal permissions are more common than anyone wants to admit.
GitHub says it caught and contained a break-in after a poisoned Visual Studio Code add-on infected an employee device, leading to unauthorized access to internal code repositories. The company says it yanked the bad version, isolated the laptop, and kicked off its emergency response fast. But online, the official explanation was basically just the opening act — the real chaos was in the comments, where people instantly latched onto one jaw-dropping detail: reports that 3,800 internal repos were exposed.
That number became the main character. One camp was stunned that GitHub even has that many private code lockers, with one commenter bluntly asking, “The real question is why github has 3800 internal repo...” Another camp pushed back on the panic, arguing it’s normal for developers at big companies to have broad access, and questioning whether anyone actually copied that much data without alarms going off. Then came the weary insiders with the most ominous vibe of all: security corners get cut all the time because protections are seen as slowing work down. One former employee at a major social media company casually dropped that getting permission to do catastrophic damage was way too easy, which only made the thread feel less like a one-off mishap and more like a peek behind Big Tech’s messy curtain.
The mood? Equal parts alarm, disbelief, and gallows humor. People weren’t just reacting to a hack — they were roasting the idea that one dodgy add-on on one laptop could open the door to a mountain of company secrets.
Key Points
- •GitHub disclosed unauthorized access to its internal repositories.
- •The company said it detected and contained the incident the previous day.
- •GitHub attributed the employee device compromise to a poisoned VS Code extension.
- •The malicious extension version was removed as part of the response.
- •GitHub isolated the affected endpoint and began incident response immediately.