1-Click GitHub Token Stealing via a VSCode Bug
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
A security researcher demonstrates a 1-click attack on github.dev that steals a victim's GitHub OAuth token with read/write access to all their repositories, including private ones. The exploit chains several VSCode behaviors: webview keydown events bubble up to the main window without validation, allowing injected JavaScript in a Jupyter notebook markdown cell to simulate keystrokes. This triggers installation of a local workspace extension (bypassing publisher trust checks), which then installs an attacker-controlled extension that exfiltrates the GitHub API token. The post includes a live PoC link, full source code, mitigation steps (clearing github.dev site data), and explains why the researcher chose full public disclosure after a poor prior experience with Microsoft's MSRC.
