GitHub Confirms 3,800 Internal Repos Exfiltrated After Employee Installed Poisoned Nx Console VS Code Extension

Timeline

1. 2026-05-19

   TeamPCP poisons Nx Console 18.95.0 as part of the Mini Shai-Hulud supply chain campaign; malicious version available on VS Code Marketplace for ~18 minutes, OpenVSX for ~36 minutes

2. 2026-05-20

   GitHub employee installs poisoned Nx Console extension; payload harvests credentials for GitHub (via gh CLI), AWS, Kubernetes, GCP/Docker, and Claude Code

3. 2026-05-20

   TeamPCP uses stolen GitHub credentials to exfiltrate ~3,800 internal GitHub repositories including Copilot internals and GitHub Actions workflow source

4. 2026-05-21

   GitHub detects compromise, isolates endpoint, removes malicious extension from VS Code Marketplace, begins rotating critical secrets; TeamPCP lists stolen repos on Breached forum for $50K minimum

5. 2026-05-22

   GitHub CISO Alexis Wales publishes blog post confirming Nx Console as the attack vector; GitHub links breach to TanStack npm supply-chain attack; Nx team confirms developer was compromised via stolen gh CLI credentials

Technical breakdown

• The attack exploited the VS Code extension update pipeline: Nx Console 18.95.0 was poisoned by compromising the TanStack build infrastructure (itself breached in the broader Mini Shai-Hulud campaign), giving TeamPCP a trusted auto-update delivery channel into developer workstations.
• The malicious extension payload targeted developer credential stores broadly — npm tokens, AWS access keys, Kubernetes configs, GCP/Docker credentials, GitHub tokens via the gh CLI, and Claude Code API keys — treating the developer workstation as a credential harvesting surface.
• Stolen GitHub credentials were used to run workflows and clone repositories 'as a contributor,' bypassing GitHub's IP allowlists and authentication controls because the credentials were legitimately issued to the victim developer.
• The 18-minute marketplace availability window was sufficient for real-world compromise: low download counts (28 on VS Code Marketplace, 41 on OpenVSX) still resulted in at least one GitHub employee installation — demonstrating that supply chain attacks don't require wide distribution to cause critical impact.
• Harvested Claude Code API keys mean attackers can now impersonate developer agent sessions — submitting code changes, triggering CI/CD pipelines, or accessing codebases through the agentic surface with full credential legitimacy but without the credential owner's knowledge or intent.