--- title: "A poisoned VS Code extension led to a GitHub breach, and Microsoft owns every link in the chain" url: https://daily.dev/posts/a-poisoned-vs-code-extension-led-to-a-github-breach-and-microsoft-owns-every-link-in-the-chain-37o7lcyl2 source_url: https://www.xda-developers.com/poisoned-vs-code-extension-github-breach-microsoft-owns-every-link type: article source: "XDA Developers" published: 2026-05-26T22:05:02.876Z updated: 2026-05-26T22:08:31.770Z tags: ["security", "cyber", "github", "vscode"] reading_time: 11 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # A poisoned VS Code extension led to a GitHub breach, and Microsoft owns every link in the chain **[XDA Developers](https://daily.dev/sources/xda-developers)** · 11 min read · 0 upvotes · 0 comments ## Summary A trojanized version of the Nx Console VS Code extension (2.2M installs) was published to the Visual Studio Marketplace in May 2026, remaining live for just 18 minutes before takedown. In that window, VS Code's auto-update mechanism silently distributed the malicious build, which stole credentials from a GitHub employee's machine and enabled cloning of roughly 3,800 internal GitHub repositories. The attack exploited a chain of weaknesses all owned by Microsoft: the npm ecosystem (under GitHub), the VS Code Marketplace, VS Code's auto-updater, and GitHub itself. The poisoned extension was part of a broader campaign by TeamPCP (UNC6780), which also hit TanStack, OpenAI, Grafana Labs, Trivy, and LiteLLM. Structural issues highlighted include: no extension sandboxing, silent auto-updates with no delay option, token-based publishing with no second factor, and trust signals (verified badge, high install count) that actually amplify attacker reach. Microsoft's scanning and vetting processes are acknowledged as insufficient, with key protections still on the roadmap. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#github](https://daily.dev/tags/github), [#vscode](https://daily.dev/tags/vscode) [View this post on daily.dev](https://daily.dev/posts/a-poisoned-vs-code-extension-led-to-a-github-breach-and-microsoft-owns-every-link-in-the-chain-37o7lcyl2)