The internal source code stolen from GitHub in May is allegedly back on the market, and this time the seller is showing samples to prove it.
A listing surfaced today offers what is described as GitHub's internal source code for $65,000, with the price marked negotiable. To establish credibility, the seller attached a sample pack rather than relying on claims alone — the standard playbook for moving stolen data on criminal forums, where buyers assume every listing is a scam until proven otherwise.
Cyber Kendra reviewed the samples at a surface level. They consist of compressed archives named after GitHub-internal projects, a directory listing of the company's main Rails application (the codebase that runs GitHub itself), several repositories belonging to internal security and tooling teams, and a manifest running to roughly 3,800 repository names — a figure that lines up closely with what GitHub confirmed in May.
A handful of loose Ruby files from the main application round out the pack. Each archive folder carries a commit identifier, consistent with a bulk clone rather than a hand-assembled fake.
Cyber Kendra is not publishing file contents, internal paths, or details of the security tooling involved, and cannot independently verify the credibility of the shared codes. Nothing here confirms the material is genuine; it confirms only that the samples are structured the way a real clone would be.
On May 20, GitHub confirmed that attackers cloned roughly 3,800 internal repositories after an employee's device was compromised by a poisoned Visual Studio Code extension — a plugin that runs inside a developer's editor with access to files, terminals, and stored credentials. Researchers traced it to a trojanized build of the Nx Console extension that stayed live on the marketplace for about 18 minutes, long enough to harvest tokens, SSH keys, and cloud credentials that the attackers then used to pull GitHub's code.
The group behind it, TeamPCP — tracked by Google's threat team as UNC6780 — spent 2026 running supply-chain attacks across npm, PyPI, and developer tooling. GitHub has consistently said customer repositories and enterprise data sit outside the affected internal systems.
That assurance still holds, but it does not make the resale harmless. Internal code and tooling give hostile researchers a map: easier vulnerability hunting, more convincing service impersonation, and sharper phishing aimed at developers. Stolen code also does not expire. A trove that failed to sell in May can resurface at a new price months later, and each recirculation widens the pool of people holding it.
For teams downstream, the hygiene items have not changed. Rotate GitHub tokens and CI/CD credentials used during the early-May window. Audit .vscode and .claude directories for files you cannot account for.
Treat unsolicited breach-themed emails as phishing until proven otherwise. And review which editor extensions your developers actually need — a single trusted plugin, auto-updating without a review gate, remains one of the shortest paths into an organization.
We have reached GitHub for the comment, and will update the story accordingly.