GitHub is just the latest victim of TeamPCP, a gang that has carried out a spree of software supply chain attacks.

The attacks are part of a wider campaign known as Mini Shai-Hulud, which has already compromised several open source projects and, in turn, developers and companies that use them.

GitHub blamed the latest in a growing list of hacks claimed by TeamPCP on a poisoned VS Code extension.