- An X account claims to offer GitHub source code for $65,000, with the price open to negotiation.
- The offer appeared after GitHub confirmed unauthorized access to about 3,800 internal repositories.
- Online users questioned the alleged sale, but no evidence links the $65,000 offer to the GitHub incident.
An X account using the name 艾比瑞恩 and the handle @Abyrion claims to have GitHub source code for sale. The account listed the asking price at $65,000, while also saying the price could be negotiated. The seller included a TOX contact identifier with the post, apparently inviting interested buyers to make private contact.
The post attracted several reactions from other X users. Some questioned the price, while others dismissed the offer. The account did not publicly explain what specific source code it allegedly holds. It also did not identify the original owner of the code.
There is also no public evidence showing that the account actually possesses the material it claims to sell. The offer appeared after a separate GitHub security incident that involved the company’s internal repositories.
X Account Offers Alleged GitHub Source Code
GitHub confirmed in May 2026 that an attacker gained unauthorized access to its internal repositories. According to GitHub’s investigation update, the incident involved a compromised employee device and a poisoned “Visual Studio Code” extension. GitHub said it removed the malicious extension and isolated the affected device after detecting the attack.
The company said its investigation found evidence of activity involving GitHub’s internal repositories. GitHub also said the attacker’s claim involving about 3,800 repositories matched its investigation in broad terms. However, GitHub said it had found no evidence that customer information outside its internal repositories was affected.
The incident later became linked in reports to a threat actor known as TeamPCP. MyBroadband reported that TeamPCP allegedly offered stolen GitHub data for sale. The report said the group initially sought at least $50,000 for the alleged material.
It later claimed that someone had offered $95,000. MyBroadband also reported that GitHub considered claims about roughly 3,800 repositories broadly consistent with its investigation.
News9Live also reported that TeamPCP claimed to have stolen GitHub’s proprietary data and source code. The report said GitHub had not found evidence that customer repositories or outside organizations were affected.
These details provide the background for the latest $65,000 offer on X. However, no available evidence connects the @Abyrion account to TeamPCP or the May GitHub incident.
The two claims also involve different seller identities and different asking prices. For that reason, the $65,000 offer should remain separate from the confirmed GitHub incident unless new evidence establishes a connection.
X Users Question the $65,000 Price
The alleged sale quickly drew skeptical reactions from members of the X community. One account, @ondrejnovakdev, responded by suggesting that people could save the $65,000 by simply cloning the Git repository. The response appeared to question why anyone would pay such a large amount for the alleged source code.
Another account, @JustWantToQ1, questioned who would actually pay $65,000 for the material. The user argued that the value would depend on what the alleged code could do and how useful it remained.
The account also suggested that making the offer public could affect the value of the material. According to the user’s argument, public attention could encourage people to move away from affected software or services.
Other users took a more dismissive view of the offer. An account using the name 𝔰𝔶𝔨 𝔡𝔢𝔩 𝔰𝔲𝔯, with the handle @pwn4tv, mocked the seller’s limited activity.
While this offer may be questionable, cybercriminals have become increasingly sophisticated in their use of the platform, with a fake GitHub campaign recently employing AI to trick users into downloading malware.
The account pointed out that the seller had made only one post before leaving the platform. Another profile, @olidotexe, simply dismissed the alleged sale and said nobody would buy it.
Meanwhile, @gladosb5 offered a different reaction to the price. The account suggested that $65 was cheap and encouraged the seller to seek a price closer to $65,000. The different responses show that users remain unsure about the claim and its alleged value. No public information currently confirms that the seller transferred the material to a buyer.
GitHub Breach Remains Separate from New Claim
The May GitHub incident remains the only confirmed event involving unauthorized access to GitHub’s internal repositories. GitHub said the attack involved a compromised employee device and a poisoned Visual Studio Code extension.
The company also said the activity involved GitHub-internal repositories and found no evidence affecting customer repositories or organizations outside those systems. Reports about the incident also described claims that thousands of internal repositories were stolen.
The Hacker News reported that the incident involved a compromised employee device and a malicious Visual Studio Code extension. The publication also quoted GitHub’s position that it had zero proof of an impact on customer information saved outside its in-house repositories.
The separate @Abyrion post does not provide enough public information to establish that it involves the same data. It also does not show that the alleged source code came from the May incident.
The $65,000 price also differs from the $50,000 starting price previously reported in connection with TeamPCP. For now, the two claims should therefore be treated as separate matters.
The @Abyrion post remains an unverified offer for alleged GitHub source code, while GitHub has publicly confirmed unauthorized access to its internal repositories. Further evidence would be needed before connecting the X account’s alleged sale to the earlier GitHub security incident.
