GitHub Internal Repositories Breached via Malicious Nx Console VS Code Extension

GitHub Internal Repositories Breached via Malicious Nx Console VS Code Extension Ravie LakshmananMay 21, 2026Supply Chain Attack / Developer Tools GitHub on Wednesday officially confirmed that the breach of its internal repositories was the result of a compromise of an employee device involving a poisoned version of the Nx Console Microsoft Visual Studio Code (VS Code) extension.  The development comes as the Nx team revealed that the extension, nrwl.angular-console, was breached after one of its developers' systems was hacked in the wake of the recent TanStack supply chain attack. Other companies that were impacted by the TanStack compromise include OpenAI, Mistral AI, and Grafana Labs. "We have no evidence of impact to customer information stored outside of GitHub's internal repositories, such as our customer's own enterprises, organizations, and repositories," Alexis Wales, Chief Information Security Officer of GitHub, said in a statement. "Some of GitHub's internal repositories contain information from customers, for example, excerpts of support interactions. If any impact is discovered, we will notify customers via established incident response and notification channels." The attack is said to have allowed the threat actor, a cybercriminal group known as TeamPCP, to exfiltrate about 3,800 repositories. GitHub said it has taken steps to contain the incident and rotated critical secrets, adding it's continuing to monitor the situation for follow-on activity. In a post on X, Jeff Cross, co-founder of Narwhal Technologies, the company behind nx.dev, said, "this incident highlights that there need to be deeper, more fundamental changes to how we and other maintainers need to think about securing developer tooling and open source distribution." "We're also beginning conversations with other high-profile open source maintainers about how we can work together on some of the deeper structural problems around software supply chain security. A lot of the assumptions the ecosystem has operated under for years no longer hold." In recent months, TeamPCP has rapidly gained notoriety for large-scale software supply chain attacks, specifically going after widely-used open-source projects and security-adjacent tools that developers rely on. What's notable here is that the trojanized version of the VS Code extension was live on Visual Studio Marketplace only for 18 minutes (between 12:30 p.m. and 12:48 p.m. UTC on May 18, 2026). But this short window was enough for the attackers to distribute a credential stealer capable of harvesting sensitive data from 1Password vaults, Anthropic Claude Code configurations, npm, GitHub, and Amazon Web Services (AWS). "The extension looked and behaved like normal Nx Console, but on startup it silently ran a single shell command that downloaded and executed a hidden package from a planted commit on the official nrwl/nx GitHub repository," OX Security researcher Nir Zadok said. "The command was disguised as a routine MCP setup task so it would not raise suspicion." The interlinked nature of modern software has allowed TeamPCP to unleash a self-sustaining cycle of new compromises. The pattern that drives home this aspect is deceptively simple as it's nefarious: break into one trusted tool, steal credentials from developer systems that may install it, and use those credentials to break into the next legitimate tool. "Every popular extension marketplace ships with auto-update on by default. VS Code, Cursor, the whole lineup," Aikido security researcher Raphael Silva said. "The reasoning makes sense in isolation, because most developers never update anything manually, so leaving it off means a long tail of editors running stale, vulnerable code." "The trade-off stops making sense once you account for hostile/compromised publishers. Auto-update gives an attacker who controls a release a direct push channel into every machine running that extension. Marketplaces don't impose any review gate or waiting period between when an update is published and when installed clients pull it in." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share SHARE  Credential Theft, cybersecurity, data breach, Developer Tools, GitHub, Malware, Open Source, Supply Chain Attack, TeamPCP, VS Code Extension ⚡ Top Stories This Week Windows Zero-Days Expose BitLocker Bypasses And CTFMON Privilege Escalation cPanel CVE-2026-41940 Under Active Exploitation to Deploy Filemanager Backdoor Microsoft's MDASH AI System Finds 16 Windows Flaws Fixed in Patch Tuesday On-Prem Microsoft Exchange Server CVE-2026-42897 Exploited via Crafted Email Mini Shai-Hulud Worm Compromises TanStack, Mistral AI, Guardrails AI and More Packages Cisco Catalyst SD-WAN Controller Auth Bypass Actively Exploited to Gain Admin Access ThreatsDay Bulletin: PAN-OS RCE, Mythos cURL Bug, AI Tokenizer Attacks, and 10+ Stories Hackers Used AI to Develop First Known Zero-Day 2FA Bypass for Mass Exploitation Microsoft Patches 138 Vulnerabilities, Including DNS and Netlogon RCE Flaws New Exim BDAT Vulnerability Exposes GnuTLS Builds to Potential Code Execution New Fragnesia Linux Kernel LPE Grants Root Access via Page Cache Corruption ⚡ Weekly Recap: Linux Rootkit, macOS Crypto Stealer, WebSocket Skimmers and More Ollama Out-of-Bounds Read Vulnerability Allows Remote Process Memory Leak 18-Year-Old NGINX Rewrite Module Flaw Enables Unauthenticated RCE [Webinar] How Modern Attack Paths Cross Code, Pipelines, and Cloud Four OpenClaw Flaws Enable Data Theft, Privilege Escalation, and Persistence Load More ▼ ⭐ Featured Resources [Guide] Stop Email Fraud Before It Turns Into Ransomware Damage [eBook] Get the 3-Number SOC Diagnostic to Reduce Queue Risk [Webinar] Learn How to Handle Critical SOC Alerts With AI Support Identify Internal Attack Surfaces More Efficiently With a Free Assessment