GitHub Breached — Employee Device Hack Led to Exfiltration of 3,800+ Internal Repos

A wave of high-impact supply-chain breaches, active exploits, and malware disclosures was reported. GitHub says an employee device compromise tied to threat actor TeamPCP led to unauthorized access and the listing/sale of 3,800+ internal repositories; Grafana also disclosed a GitHub token breach and extortion attempt tied to a TanStack npm compromise. Multiple supply-chain and developer-targeting incidents surfaced — malicious/compromised npm packages (Mini Shai‑Hulud, Shai‑Hulud clones), a compromised Nx Console VS Code extension that stole credentials, and a hijacked GitHub Action that exfil