---
title: "1-Click GitHub Token Stealing via a VSCode Bug"
url: https://daily.dev/posts/1-click-github-token-stealing-via-a-vscode-bug-bjvyhct2p
source_url: https://blog.ammaraskar.com/github-token-stealing
type: article
source: "Lobsters"
published: 2026-06-03T09:30:56.470Z
updated: 2026-06-03T09:31:23.810Z
tags: ["security", "github", "vscode"]
reading_time: 13
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# 1-Click GitHub Token Stealing via a VSCode Bug

**[Lobsters](https://daily.dev/sources/lobsters)** · 13 min read · 0 upvotes · 0 comments

## Summary

A security researcher demonstrates a 1-click attack on github.dev that steals a victim's GitHub OAuth token with read/write access to all their repositories, including private ones. The exploit chains several VSCode behaviors: webview keydown events bubble up to the main window without validation, allowing injected JavaScript in a Jupyter notebook markdown cell to simulate keystrokes. This triggers installation of a local workspace extension (bypassing publisher trust checks), which then installs an attacker-controlled extension that exfiltrates the GitHub API token. The post includes a live PoC link, full source code, mitigation steps (clearing github.dev site data), and explains why the researcher chose full public disclosure after a poor prior experience with Microsoft's MSRC.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://blog.ammaraskar.com/github-token-stealing>

## Similar posts on daily.dev

- [GitHub.dev flaw lets attackers steal OAuth tokens in one click](https://daily.dev/posts/github-dev-flaw-lets-attackers-steal-oauth-tokens-in-one-click-tounneovz) · The Next Web · 0 upvotes · 0 comments
- [VS Code zero-day lets hackers steal GitHub tokens in one click](https://daily.dev/posts/vs-code-zero-day-lets-hackers-steal-github-tokens-in-one-click-dg7cfn1yn) · BleepingComputer · 0 upvotes · 1 comments
- [Hole in GitHub’s browser-based VSCode editor could lead to stolen token](https://daily.dev/posts/hole-in-github-s-browser-based-vscode-editor-could-lead-to-stolen-token-mfj7z99ko) · InfoWorld · 0 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#github](https://daily.dev/tags/github), [#vscode](https://daily.dev/tags/vscode)

[View this post on daily.dev](https://daily.dev/posts/1-click-github-token-stealing-via-a-vscode-bug-bjvyhct2p)