I have kept a supply chain watch for years, and May 2026 stands out. In a few weeks, GitHub has stacked up an internal security breach, sagging reliability and the announced departure of flagship projects to other forges. On social media, the verdict lands fast: "open source is in crisis."
I disagree with that shortcut. I think we are conflating three things: GitHub the company, software supply chain security, and open source itself. This post puts those three subjects back in their place. And since the situation shifts every week, I will keep enriching it over time, so treat it as an open chronicle.
The breach that tips the scales
On 20 May 2026, GitHub's official account posts a short message: "We are investigating unauthorized access to GitHub's internal repositories." GitHub is investigating unauthorized access to its internal repositories, with no evidence, at this stage, of impact on customer data.
The details were reported afterwards by the specialist press. According to BleepingComputer, GitHub confirmed that roughly 3,800 internal repositories were affected. According to GitHub, the incident starts from a compromised employee workstation: a malicious VS Code extension installed on that machine served as the entry point, the extension name is not public in the sources consulted. This is therefore not a flaw in GitHub's infrastructure, but a compromise of a developer's toolchain.
The attack is claimed by a group called TeamPCP, which offers the stolen dataset for sale at a minimum of 50,000 dollars. GitHub has not published any official attribution, the claim remains, at this stage, the attacker's word. But that name is not unknown: Microsoft and Palo Alto Networks' Unit 42 have linked TeamPCP to the compromise campaign of Trivy and Checkmarx KICS earlier this year. If the claim holds up, it is the same actor moving from the package to the forge, a campaign climbing the software supply chain toward its summit.
A platform running out of breath
The breach does not land in a clear sky. It adds to a string of signals piling up over months.
Reliability, first. According to an IncidentHub analysis relayed by LeadDev, GitHub reportedly had 257 incidents between May 2025 and April 2026, including 48 major outages, that is, on average, one significant disruption per week. GitHub publishes its own monthly availability reports without giving that aggregate total; the figure therefore remains a third-party estimate. GitHub does acknowledge the pressure: the growth of agentic workflows since late 2025 forces it to aim for far more infrastructure capacity than it has today. For a platform that has become one of the centers of gravity of global software development, these strains raise questions.
Governance, next. In late 2025, CEO Thomas Dohmke left GitHub. Microsoft named no successor: GitHub was folded into Microsoft's CoreAI organization, and its leaders now report to several executives at the parent company. GitHub no longer has a captain of its own, it has become a building block of Microsoft's AI strategy.
Product decisions, finally, crystallize the discontent. The increasingly intrusive integration of Copilot, to the point where GitHub had to backtrack on advertising "tips" injected into pull requests after the community outcry, gives the sense of a platform pushing its AI agenda ahead of its users' needs.
Projects are leaving GitHub
It is in this context that projects are leaving GitHub. And not just any projects.
The most discussed case is Ghostty, the terminal emulator with over 50,000 stars. Its creator is no stranger: Mitchell Hashimoto, HashiCorp founder, behind Vagrant, Terraform and Vault. In late April 2026, he announces that Ghostty will leave GitHub, mainly for reliability reasons. The destination forge is not yet finalized, a read-only mirror will stay on GitHub. The signal matters more than the destination here: a maintainer of that weight walking away is not a whim.
The Gentoo Linux project, for its part, has settled its destination: it is migrating its mirrors and its contributions to Codeberg, explicitly citing the repeated Copilot solicitations. Gentoo does keep its core infrastructure self-hosted, so the migration is partial and targeted. And these two names are only the visible part: the community observes a steady trickle of "why I am leaving GitHub" posts and repositories switching over.
The most cited destination is Codeberg, a forge that runs the Forgejo software. The detail matters: Forgejo is a community fork of Gitea, placed under the umbrella of Codeberg e.V., a German non-profit association, with democratic governance and fully free code. In other words, the projects that migrate are not leaving one commercial platform for another: they are switching to an association-run, free and community-governed infrastructure.
The through line: the developer environment has become the target
If I connect the dots of these past weeks, a pattern emerges, and it is anything but reassuring. The GitHub breach starts from a booby-trapped VS Code extension. The Shai-Hulud worm, which I covered in a dedicated post, steals Claude Code configuration files and plants backdoors in VS Code. The wave of tag poisoning attacks, Trivy, Checkmarx KICS, xygeni, targets GitHub Actions, that is, developers' pipelines.
The common thread is no longer the production server. It is the developer's workstation and its toolchain. That workstation is no longer a simple access terminal to the code: it is a privilege concentration zone. On a single machine coexist GitHub tokens, SSH keys, npm and PyPI access, cloud credentials, editor extensions, AI agents, local configuration files and access to CI runners.
For a supply chain attacker, compromising that environment often means obtaining a shortcut to software publishing, secrets and sometimes entire organizations. That is why the developer workstation now deserves the same care as an exposed server. The guide Attacks through package managers in CI/CD details this mechanism.
So, is open source in crisis?
I come back to the opening question. My answer rests on a distinction.
GitHub is going through, at the very least, a crisis of confidence. Security breach, degraded reliability, loss of organizational autonomy, contested product decisions around Copilot: the company is stacking up a bundle of doubts it can no longer treat as a mere rough patch.
Software supply chain security is going through a crisis, that is just as true. The attacks have industrialized: self-replicating worms, organized groups like TeamPCP, systematic targeting of maintainers, forges and the toolchain.
But open source itself is not in an existential crisis. It keeps producing, attracting contributors, forking and organizing. The projects that "leave" GitHub are not leaving open source, they are leaving a commercial platform for an association-run, free forge. That is the opposite of a collapse: it is the sign that the ecosystem has credible alternatives and that projects can genuinely switch platforms when the current one no longer suits them.
What is in crisis, on the other hand, is the dominant infrastructure of open source. Too many projects, workflows, identities, secrets and automations rest on a single commercial platform. It is a centralization crisis. We conflated open source and GitHub; we let a single forge become the de facto centralization point of global development. When that center wobbles, a breach, a strategic pivot, a weekly outage, the whole ecosystem trembles. The fragility is not in the open source model: it is in the monoculture we built around it.
Seen from that angle, the departures to Codeberg are not a symptom of death. They are a re-decentralization, a modest but real return to the plurality that made open source robust before a single forge absorbed everything.
What I take away, concretely
- Do not conflate open source and GitHub. GitHub is a commercial host. Open source is a model. One can go badly wrong without the other being threatened.
- Reduce dependence on a single forge. Keeping a mirror of your critical repositories on a second forge, or self-hosted, is no longer paranoia: it is business continuity.
- Treat the developer workstation as a target. Editor extensions, CI runners, package managers, AI agents: that is where privileges concentrate, and where the 2026 attacks play out. Auditing your extensions is worth as much as auditing your dependencies.
- Support the alternatives. Forgejo, Codeberg and the association-run forges will only survive if the community uses them, funds them and contributes to them. Diversity is not decreed, it is maintained.
This post will be enriched
I chose to make it an open chronicle. GitHub's situation moves every week; the full incident report is not published yet; other projects will no doubt announce their departure, and their destinations. I will update this post, the modification date at the top of the page will be the reference.
If you spot a signal worth including, write to me. A chronicle also feeds on the field its readers walk.
Going further
On the blog:
- Shai-Hulud returns: an npm worm loots the AntV ecosystem, the npm attack that backdoors Claude Code and VS Code.
- Attacks through package managers in CI/CD, the mechanics of toolchain compromises.
- Software supply chain security, the full dossier.
Sources for this post:
- The breach, GitHub's statement on X and BleepingComputer's analysis.
- Reliability and governance, the investigation "What's gone wrong at GitHub?" by LeadDev and the post "Goodbye, GitHub" on the official blog.
- The departures, "Ghostty Is Leaving GitHub" by Mitchell Hashimoto and the migration announcement of Gentoo to Codeberg.
- The TeamPCP campaign, Microsoft Security's analysis of the Trivy compromise and that of Palo Alto Networks' Unit 42.