Supply Chain

GitHub Was Breached Through an Editor Extension

June 4, 2026 No comments yet

GitHub – the company responsible for half the world’s code – was breached through a VS Code extension. Yes, you read that correctly.

A GitHub employee installed an extension called Nx Console. A poisoned version. The extension stole their credentials, gave the attackers access to the internal network, and from there they pulled 3,800 internal repositories belonging to GitHub itself.

An attack group called TeamPCP put the code up for sale on a forum for forty-nine thousand dollars. Nobody bought it? Then they threatened to release it all for free.

Let’s stop and understand what happened here

GitHub. The company that holds your code. The company that supplies the tooling, the CI/CD, Copilot. Breached because somebody installed an extension.

Not a zero-day. Not a sophisticated state-level attack. An extension.

And that is exactly the problem. We treat the VS Code Marketplace as though it were a secure store. We install extensions the way we install apps on a phone – click, approve, forget. But that Marketplace is the wild west. There is no serious code signing. There is no real sandboxing. The extension runs with the same permissions as the IDE itself.

Which means: full access to files, to the terminal, to credentials, to SSH keys, to git tokens. All of it.

Now think about your own company

How many extensions are installed on your developers’ machines? Twenty? Thirty? Fifty? Who approved them? Who reviewed their code? Who checks the updates?

In most companies, the answer is nobody.

And I will tell you from experience – at AppSec Labs we see this at clients all the time. Attackers moved from phishing over email to phishing over the supply chain. They do not need to break into your server. They need to compromise one popular extension, and you bring them inside yourself.

If GitHub, with all their resources and knowledge, could not prevent this – what chance does your startup with three developers have?

Three things to do tomorrow morning

  • Produce a list of every extension installed across the organisation.
  • Block installation of extensions that have not been approved.
  • Run a scan over the existing ones – including permissions and network traffic.

This is not paranoia. It is the minimum. GitHub learned the lesson at a cost of 3,800 repositories. You do not have to learn it at the same price.

I first shared a version of this as a LinkedIn post on 2026-06-04. It is republished here, lightly edited, so it is easier to find and reference. — Erez Metula