GitHub Internal Repo Breach Linked to Compromised Nx Console VS Code Extension

The breach originated when a developer’s account for the nrwl/angular‑console extension was hijacked, likely in the wake of the TanStack supply‑chain incident. Attackers published a poisoned version of the extension that appeared legitimate but executed a hidden shell command on startup, downloading a credential‑stealer from a planted commit in the official nrwl/nx repository.

- The trojanized extension was available from 12:30 p.m. to 12:48 p.m. UTC on May 18 2026, a window of 18 minutes. - TeamPCP used the stolen credentials to harvest data from 1Password vaults, Anthropic Claude Code configurations, npm, GitHub, and AWS accounts. - Approximately 3,800 GitHub internal repositories were exfiltrated; some contained customer support excerpts. - GitHub’s CISO stated there is no evidence of impact to customer‑owned repositories outside the internal set, and affected secrets have been rotated.

The incident shows how a brief window in a trusted extension marketplace can lead to large‑scale credential theft when auto‑update is enabled. It underscores the risk of relying on publisher reputation without additional verification, especially for widely used developer tooling.

- Disable automatic updates for VS Code extensions or enforce strict version pinning in enterprise environments. - Require multi‑factor authentication and least‑privilege access for extension publisher accounts. - Monitor the Visual Studio Marketplace for unexpected version bumps and verify publisher signatures before deployment. - Deploy endpoint detection and response (EDR) rules that flag execution of unknown shell commands from extension startup scripts. - Rotate any secrets that may have been exposed, including API keys, tokens, and service accounts used by developers. - Implement software bill of materials (SBOM) checks for extensions and enforce policy‑based approval for new or updated extensions.