--- title: GitHub breach via poisoned VS Code extension, Starlette... description: A week of severe supply chain attacks: a trojanized Nx Console VS Code extension was live for 18 minutes, enough to compromise a GitHub employee's machine and... canonical: https://daily.dev/posts/github-breach-via-poisoned-vs-code-extension-starlette-cve-exposes-millions-of-ai-agents-brrwlb4ws twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: GitHub breach via poisoned VS Code extension, Starlette CVE exposes millions of AI agents | daily.dev og:description: A week of severe supply chain attacks: a trojanized Nx Console VS Code extension was live for 18 minutes, enough to compromise a GitHub employee's machine and... og:url: https://daily.dev/posts/github-breach-via-poisoned-vs-code-extension-starlette-cve-exposes-millions-of-ai-agents-brrwlb4ws og:image: https://api.daily.dev/og/posts/bRRWlb4wS.png og:image:alt: GitHub breach via poisoned VS Code extension, Starlette CVE exposes millions of AI agents og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # GitHub breach via poisoned VS Code extension, Starlette CVE exposes millions of AI agents **[Backend Digest](https://daily.dev/sources/backend_digest)** · 5 min read · 0 upvotes · 0 comments ## Summary A week of severe supply chain attacks: a trojanized Nx Console VS Code extension was live for 18 minutes, enough to compromise a GitHub employee's machine and expose ~3,800 internal repos. A critical path-bypass CVE (CVE-2026-48710) in Starlette affects FastAPI, vLLM, and most MCP servers — patch to 1.0.1 immediately. The Megalodon campaign injected backdoored GitHub Actions workflows into 5,500+ repos in six hours, targeting cloud credentials and OIDC tokens. A new TrapDoor malware campaign across npm, PyPI, and Crates.io specifically targets AI coding assistant config files (.cursorrules, CLAUDE.md) to manipulate context windows and exfiltrate secrets. Also covered: OpenTelemetry CNCF graduation, Redis 8.4 XREADGROUP improvements, Vercel's Firecracker-based build platform, Kubernetes CVE corrections, and more. ## Content **TLDR:** A trojanized Nx Console extension spent 18 minutes in the VS Code Marketplace and that was enough to compromise a GitHub employee's machine and expose roughly 3,800 internal repositories. Separately, a critical path-bypass vulnerability in Starlette — the ASGI framework under FastAPI, vLLM, and most MCP servers — is trivially exploitable and a fix is available in 1.0.1. The GitHub Actions Megalodon campaign also hit 5,500+ repos in six hours, targeting CI secrets. Supply chain security is having a very bad week. --- ## Poisoned Nx Console extension leads to GitHub breach A malicious build of the Nx Console VS Code extension (2.2M installs) was live for 18 minutes before takedown — long enough for VS Code's silent auto-updater to distribute it and steal credentials from a GitHub employee. The attacker group TeamPCP (UNC6780) used those credentials to clone around 3,800 internal GitHub repositories. What makes this uncomfortable is that Microsoft owns every link in the attack chain: the npm ecosystem, the VS Code Marketplace, the auto-updater, and GitHub itself. The structural problems — no extension sandboxing, no update delay option, token-based publishing with no second factor — are all still on the roadmap rather than shipped. ## Starlette CVE-2026-48710 puts FastAPI and MCP servers at risk Dubbed "BadHost," this flaw lets attackers bypass path-based authorization by injecting a single character into the HTTP Host header. Starlette has 325 million weekly downloads and sits under FastAPI, vLLM, LiteLLM, and a wide range of MCP server implementations. Systems not behind a properly configured firewall are trivially exploitable. Patch to Starlette 1.0.1 now — an online scanner has been released to check exposure if you're not sure what's in your stack. ## Megalodon campaign hits 5,500 GitHub repos via compromised tokens On May 18, attackers pushed 5,718 malicious commits into 5,561 public repositories in six hours, abusing compromised Personal Access Tokens and deploy keys to inject backdoored GitHub Actions workflows. The payloads targeted AWS/GCP credentials, SSH keys, Kubernetes configs, and GitHub OIDC tokens. Commit timestamps were forged to look like routine CI maintenance. IOCs are published — check your workflow files if you haven't already. ## TrapDoor malware targets AI coding assistant config files A campaign spanning npm, PyPI, and Crates.io — 34 malicious packages, 384+ versions — goes beyond credential theft. It specifically targets `.cursorrules` and `CLAUDE.md` files, injecting hidden Unicode instructions to manipulate AI coding assistants into exfiltrating secrets. A compromised developer machine becomes an entry point into CI/CD pipelines. This is a meaningful escalation: attackers are now treating your AI assistant's context window as an attack surface. --- ## Also notable - **OpenTelemetry graduates at CNCF:** All three signals (traces, metrics, logs) are now production-stable, making this a reasonable time to consolidate proprietary agents — Datadog, New Relic, Splunk forwarders — behind the OTel Collector. Caveats: Ruby/PHP auto-instrumentation still lags, and graduation doesn't fix cardinality or backend pricing. - **Redis 8.4 XREADGROUP CLAIM:** Collapses the traditional multi-command reliable consumer loop into a single round trip, with benchmarks showing up to 22.5x lower latency on workloads with large PELs. The internal data structure change from rax tree to doubly-linked list adds another 28% throughput improvement. - **Vercel Hive build platform:** Reduced provisioning from 90 seconds to 5 by switching to Firecracker microVMs — VM-level kernel isolation that boots in ~125ms. The warm pool of pre-booted cells does most of the work; each cell is destroyed after every build. - **Kubernetes CVE corrections on June 1:** Three older CVEs (CVE-2020-8561, CVE-2020-8562, CVE-2021-25740) were incorrectly marked as fixed. The Kubernetes SRC is correcting records to show all versions affected — these are architectural trade-offs that can't be fully patched. Apply the documented mitigations. - **flag_shih_tzu v1.0.0:** Changes default SQL from IN() lists to bit operators for querying bit flags. The old approach breaks during rolling deploys when new flags are added. Upgrade before your next flag addition. - **Avrea raises $4.7M:** Helsinki startup positioning as an AI-aware CI/CD alternative to GitHub Actions, claiming 2-3x faster pipelines and 80% infrastructure cost reduction. Founded by Aiven and Nosto co-founders; already SOC 2 and ISO 27001 certified. - **EAGLE 3.1 speculative decoding:** Fixes "attention drift" at deeper speculation depths via FC normalization, yielding up to 2x longer acceptance length in long-context workloads. Ships in vLLM v0.22.0 with full backward compatibility for EAGLE 3 checkpoints. - **Flink Kubernetes Operator 1.15.0:** Adds Kubernetes-native Conditions to FlinkDeployment status for machine-readable state (works with kubectl wait and GitOps tools), plus Flink 2.2 compatibility and bug fixes for savepoint race conditions. - **dltHub Transformations public preview:** A Python decorator that compiles Ibis or SQL to the correct warehouse dialect without data round-tripping through Python. Cited results include a data migration completed in three weeks instead of a quarter. - **Dutch government blocks Kyndryl from buying DigiD host Solvinity:** First time the Dutch Investment Screening Bureau has blocked a US acquisition. The concern is the US CLOUD Act's reach over Dutch citizen identity data. Fits a broader European pattern that's likely to accelerate. - **GitLab 19.0 SBOM-based dependency scanning:** Now GA for Ultimate customers, tracing how vulnerable packages entered a project and checking reachability for Java, JavaScript/TypeScript, and Python across 24+ ecosystems. - **PostgreSQL now() vs clock_timestamp():** now() returns transaction start time, not wall-clock time. If you have retry loops inside a single transaction checking elapsed time, you're reading a frozen timestamp. Use clock_timestamp() instead. --- Tags: [#security](https://daily.dev/tags/security), [#github](https://daily.dev/tags/github), [#vscode](https://daily.dev/tags/vscode) [View this post on daily.dev](https://daily.dev/posts/github-breach-via-poisoned-vs-code-extension-starlette-cve-exposes-millions-of-ai-agents-brrwlb4ws) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/github-breach-via-poisoned-vs-code-extension-starlette-cve-exposes-millions-of-ai-agents-brrwlb4ws","headline":"GitHub breach via poisoned VS Code extension, Starlette CVE exposes millions of AI agents","text":"A week of severe supply chain attacks: a trojanized Nx Console VS Code extension was live for 18 minutes, enough to compromise a GitHub employee's machine and expose ~3,800 internal repos. A critical path-bypass CVE (CVE-2026-48710) in Starlette affects FastAPI, vLLM, and most MCP servers — patch to 1.0.1 immediately. The Megalodon campaign injected backdoored GitHub Actions workflows into 5,500+ repos in six hours, targeting cloud credentials and OIDC tokens. A new TrapDoor malware campaign across npm, PyPI, and Crates.io specifically targets AI coding assistant config files (.cursorrules, CLAUDE.md) to manipulate context windows and exfiltrate secrets. Also covered: OpenTelemetry CNCF graduation, Redis 8.4 XREADGROUP improvements, Vercel's Firecracker-based build platform, Kubernetes CVE corrections, and more.","url":"https://daily.dev/posts/github-breach-via-poisoned-vs-code-extension-starlette-cve-exposes-millions-of-ai-agents-brrwlb4ws","datePublished":"2026-05-27T04:18:31.004Z","dateModified":"2026-05-27T04:18:48.138Z","author":{"@type":"Organization","name":"Backend Digest","logo":"https://media.daily.dev/image/upload/s--9uCSrsAb--/f_auto,q_auto/v1773839398/logos/backend_digest?_a=BAMAMiiu0","url":"https://daily.dev/sources/backend_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/backend_digest","name":"Backend Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Backend Digest","item":"https://daily.dev/sources/backend_digest"},{"@type":"ListItem","position":3,"name":"GitHub breach via poisoned VS Code extension, Starlette CVE exposes millions of AI agents"}]} ```