A poisoned VS Code extension just cost GitHub 3,800 internal repos
Eighteen minutes. That is how long a trojanized version of the Nx Console extension lived on the Visual Studio Marketplace before someone pulled it. The window was 12:30 to 12:48 p.m. UTC on May 18, 2026. In that time, auto-update did what auto-update does: it pushed the malicious package straight to every developer machine running the extension.
On May 20, GitHub confirmed the fallout. Roughly 3,800 of its internal repositories were exfiltrated. The attacker, a group called TeamPCP (tracked by Google’s Threat Intelligence Group as UNC6780), is already advertising the stolen repos for sale starting at $50,000 on hacking forums.
How it worked
The poisoned extension looked and behaved like normal Nx Console. On startup, it silently ran a single shell command that downloaded and executed a hidden package from a planted commit on the official nrwl/nx GitHub repository. OX Security researcher Nir Zadok said the command was disguised as a routine MCP setup task to avoid suspicion.
The payload went after credentials stored in 1Password vaults, Anthropic Claude Code configurations, npm tokens, GitHub tokens, and AWS keys. Every popular extension marketplace ships with auto-update on by default. VS Code, Cursor, the whole lineup. There is no review gate between when an update is published and when installed clients pull it in.
The cascade
This was not an isolated incident. The Nx Console compromise traces back to an earlier supply chain attack on TanStack. One of Nx Console’s developers had their system breached during that earlier wave. A stolen GitHub token from the TanStack attack was then used to publish the trojanized extension.
The same chain of breaches hit OpenAI, Mistral AI, and Grafana Labs.
On the same day GitHub confirmed its breach, researchers at Endor Labs detected 639 malicious npm package versions published across 323 packages in Alibaba’s @antv ecosystem. That wave introduced provenance forgery: the worm now calls Fulcio and Rekor at runtime to generate valid Sigstore signing certificates for every package it propagates to. The provenance badge shows green. The build chain belongs to the attacker.
Microsoft’s durabletask Python SDK on PyPI was also compromised in the same timeframe.
What GitHub is saying
GitHub CISO Alexis Wales stated the company has “no evidence of impact to customer information stored outside of GitHub’s internal repositories.” Some of those internal repos contain customer data though, including excerpts of support interactions. GitHub says it will notify affected customers through established incident response channels.
Critical secrets were rotated overnight with the highest-impact credentials prioritized first.
An X account linked to TeamPCP posted after GitHub’s disclosure: “GitHub knew for hours, they delayed telling you and they won’t be honest in the future. What an amazing run, it’s been an honor to play around with the cats over the past few months.”
The structural problem
Jeff Cross, co-founder of Narwhal Technologies (the company behind Nx), said the incident highlights the need for “deeper, more fundamental changes to how we and other maintainers need to think about securing developer tooling and open source distribution.” He is beginning conversations with other high-profile open source maintainers about structural fixes.
The problem is straightforward. Break into one trusted tool, steal credentials from developer systems, use those credentials to break into the next trusted tool. TeamPCP has run at least seven confirmed waves of this pattern since March 2026, hitting Trivy, Checkmarx KICS, LiteLLM, Bitwarden CLI, TanStack, and Mistral AI before arriving at Nx Console and GitHub.
Trend Micro, StepSecurity, and Snyk all assess high confidence that these waves are connected based on toolchain overlap.
Binance co-founder CZ posted after the news broke: “If you have ANY private repos with plain text secrets or sensitive documents/architectures, immediately rotate your secrets.”