GitHub confirmed a breach where a poisoned VS Code extension led to the exfiltration of 3,800 internal repositories. Customer data was not impacted.