GitHub confirms breach of 3,800 repos via malicious VSCode extension

Re:GitHub confirms breach of 3,800 repos via malicious VSCod... by skissane on Wednesday May 20, 2026 @04:50PM (#48213941)

In my personal experience, give it a decade or two, and any corporation will accumulate hundreds (or even thousands) of abandoned internal repos containing discontinued services, POCs/prototypes that never went anywhere, etc – people forget to archive them, or aren't sure whether something is still in use or not so err on the safe side.

AI is making this even worse. With coding agents, anyone can throw together a quick internal prototype of any idea they have, even if it has no hope of ever making it to production.

[ Parent | on HN ]

Re:GitHub confirms breach of 3,800 repos via malicious VSCod... by unix4ever on Wednesday May 20, 2026 @04:57PM (#48214045)

Maybe though AI will make it better, assign agents to monitor, maintain and keep repos up to date or via A2A refer them to an agent to dispose of them in accordance with company requirements. I actually think AI will greatly help this type of problem.

[ Parent | on HN ]

Re:GitHub confirms breach of 3,800 repos via malicious VSCod... by skissane on Wednesday May 20, 2026 @06:26PM (#48215111)

Autoarchiving repos which nobody has used in X years doesn’t require any AI - you can just write a bot to do it. People don’t, because it isn’t a priority. AI can make writing such a bot a bit easier, but can’t help much with getting approval from the powers that be to run it.

[ Parent | on HN ]