Aikido Security

bigboxSWE

BleepingComputer

<h2>What happened</h2>
On May 18, 2026, a malicious version of the Nx Console VS Code extension (v18.95.0) appeared on the Visual Studio Marketplace. It was live for 11 to 18 minutes before being pulled — 36 minutes on OpenVSX. That was enough.
A GitHub employee had the extension installed with auto-update enabled. The poisoned version ran on their machine, harvested credentials, and gave attackers access to roughly 3,800 internal GitHub repositories. The hacking group TeamPCP (also tracked as UNC6780) has since claimed responsibility on the Breached cybercrime forum, where they’re offering the stolen code for at least $50,000.
GitHub confirmed the breach in a public statement: “Our current assessment is that the activity involved exfiltration of GitHub-internal repositories only. The attacker’s current claims of ~3,800 repositories are directionally consistent with our investigation so far.” The company says there’s no evidence that customer data — enterprises, organizations, or user-hosted repositories — was affected, though the investigation is ongoing.
<h2>How the attack actually worked</h2>
The Nx Console compromise didn’t start on May 18. It traces back to May 11, when TeamPCP executed a supply chain attack on the TanStack npm ecosystem, publishing malicious packages including <code>@tanstack/zod-adapter</code>.
An Nx Console contributor’s machine resolved that malicious package during a routine <code>pnpm install</code>. A minimum-release-age safeguard that should have blocked it was silently ignored by an older pnpm version — a configuration option that turned out to be a no-op. The contributor’s GitHub CLI OAuth token was stolen in the process.
Seven days later, that stolen token was used to publish the backdoored Nx Console release. The malicious payload — 2,777 bytes injected into a minified JS file — fetched a 498 KB obfuscated dropper from an orphan commit. It targeted GitHub tokens, npm tokens, AWS/GCP credentials, SSH keys, Vault tokens, and passwords, exfiltrating data over HTTPS and DNS tunneling.
The same May 19 campaign also published 637 malicious npm package versions under the AntV namespace.
<h2>GitHub’s response</h2>
GitHub moved quickly once the compromise was detected. They removed the malicious extension version, isolated the compromised endpoint, and began rotating credentials — prioritizing the highest-impact secrets first. The company is continuing to analyze logs and monitor for follow-on activity, with a fuller report promised once the investigation wraps up.
<h2>Who is TeamPCP</h2>
This isn’t a one-off. TeamPCP has a documented pattern of rapid supply chain attacks against developer infrastructure. Prior targets include:
<ul>
<li>Aqua Security’s Trivy vulnerability scanner</li>
<li>The European Commission’s AWS infrastructure (via the Trivy compromise)</li>
<li>LiteLLM</li>
<li>OpenAI employee devices (via the TanStack platform)</li>
<li>Mistral AI source code</li>
<li>PyPI, npm, and Docker ecosystems</li>
</ul>
The group’s approach is consistent: exploit trusted update mechanisms or stolen credentials, move fast, and exfiltrate before defenders can respond.
<h2>The VS Code extension problem</h2>
The Nx Console incident exposes something the security community has been pointing out for years: the VS Code Marketplace has no meaningful security review process, no kill-switch for already-installed versions, and no mechanism to notify users when an extension they have installed is later found to be malicious.
Auto-update is on by default. Extensions run with broad system permissions. And because they’re plain-text interpreted artifacts rather than compiled binaries, traditional EDR tools often miss malicious behavior entirely.
The Nx Console postmortem identified several contributing failures: the upstream TanStack compromise, a silent pnpm config no-op, locally-stored GitHub CLI credentials, and a single-actor publish pipeline with no approval gate.
<h2>What developers should do now</h2>
If you had Nx Console installed with auto-updates enabled around May 18, 2026:
<ul>
<li>Update to a clean version immediately</li>
<li>Kill any suspicious processes and remove persistent artifacts (check for unauthorized systemd services)</li>
<li>Rotate all credentials: GitHub tokens, npm tokens, AWS/GCP/Azure keys, SSH keys, anything stored in environment variables or config files</li>
<li>Audit your GitHub repositories for unauthorized activity or unexpected workflow runs</li>
</ul>
More broadly, consider disabling auto-update for VS Code extensions, or using a tool that enforces a delay before newly published extension versions are installed. The Nx Console postmortem recommends mandatory approval gates for publishing and pinned GitHub Action SHAs. StepSecurity’s Dev Machine Guard now scans extensions across VS Code, Cursor, Windsurf, JetBrains IDEs, Android Studio, Eclipse, and Xcode for supply chain signals. Aikido Security’s Device Protection enforces a 48-hour hold on recently published packages and extensions by default.
The core issue is that 11 minutes was enough. The attack surface isn’t going away, and the marketplace infrastructure hasn’t meaningfully changed. Until it does, the safest assumption is that any extension with a recent update could be a problem — and your credentials should be treated accordingly.

Collections

A malicious version of the Nx Console VS Code extension (v18.95.0) was live on the Visual Studio Marketplace for 11–18 minutes on May 18, 2026, long enough for a GitHub employee with auto-update enabled to have their credentials stolen. The breach gave attackers (TeamPCP/UNC6780) access to roughly 3,800 internal GitHub repositories. The attack chain started a week earlier with a compromised TanStack npm package that stole a contributor's GitHub CLI token, which was then used to publish the backdoored extension. The payload targeted GitHub, npm, AWS/GCP, SSH, and Vault credentials, exfiltrating data over HTTPS and DNS tunneling. GitHub confirmed no customer data was affected. TeamPCP has a documented history of rapid supply chain attacks against developer infrastructure. The incident highlights systemic weaknesses in the VS Code Marketplace: no security review, no kill-switch for installed versions, default auto-update, and broad extension permissions. Developers who had Nx Console installed around that date should rotate all credentials and audit repository activity.

GitHub confirms internal repository breach via poisoned VS Code extension

GitHub’s Reliability
<img src="https://static.klipy.com/ii/e293a233a303a98e471f78d04e13a1b0/29/98/hawsaYCo.gif" alt="GIF">

Personally, I think there’s a dangerous level of complacency happening across the developer ecosystem right now, and GitHub is not exempt from that criticism.
An extension was compromised for less than 20 minutes and that was still enough to potentially expose around 3,800 internal repositories. That should tell everyone how fragile modern development infrastructure really is.
What bothers me most is that this wasn’t some advanced zero-day exploit against hardened systems. It was a chain of very preventable problems:
<ul>
<li>Auto-updates enabled by default</li>
<li>Broad extension permissions</li>
<li>Credentials stored locally</li>
<li>No meaningful approval gate</li>
<li>No emergency kill-switch for malicious extensions</li>
<li>Silent package manager configuration failures</li>
</ul>
That’s not just a sophisticated attacker problem. That’s an operational discipline problem.
Developers have become too comfortable trusting marketplaces, extensions, npm packages, GitHub Actions, and AI tooling without slowing down and asking what actually has access to their machines and credentials.
The reality is our IDEs are now one of the biggest attack surfaces in software development.
This attack also proves something else:
Supply chain attacks are no longer targeting only companies. They’re targeting developers directly because developers hold the keys to everything.
At this point, blindly allowing extensions and packages to auto-update is starting to feel irresponsible, especially for anyone working on sensitive projects or infrastructure.
Convenience is winning over security everywhere right now, and attackers know it.