GitHub said the activity involved the exfiltration of about 3,800 internal repositories, and it removed the malicious code extension.