TeamPCP Hackers Steal 3,800 GitHub Repositories by Poisoning Trivy, LiteLLM, and VS Code Extensions

TeamPCP’s supply-chain campaign, which began with the compromise of Trivy security tooling in March 2026 and spread through stolen credentials to LiteLLM and VS Code extensions, culminated in the theft of approximately 3,800 GitHub internal repositories after a poisoned Nx Console extension compromised an employee’s device, according to GBHackers reporting on GitHub’s disclosure. GitHub says the count is directionally consistent with its investigation, reports no evidence that customer-owned repositories were affected, and says some internal repositories contained customer information including excerpts from support interactions.