GitHub.dev flaw lets attackers steal OAuth tokens in one click
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
A security researcher has disclosed a one-click exploit in GitHub.dev (the browser-based VS Code editor) that steals full GitHub OAuth tokens. The attack chains a malicious Jupyter Notebook file, a hidden JavaScript payload in a webview iframe, simulated keyboard events via postMessage, and a local workspace extension to silently install a rogue extension that exfiltrates the OAuth token — granting access to all private repositories the victim can reach. The flaw bypasses VS Code's publisher trust prompt via local workspace extensions and is worsened by GitHub.dev's lack of CSRF tokens. Microsoft has acknowledged the issue but has not yet shipped a fix. The researcher disclosed publicly after a prior negative experience with Microsoft's Security Response Centre. Developers are advised to avoid clicking unfamiliar GitHub.dev links, audit .vscode/extensions folders, and review OAuth token permissions until a patch is available.
