GitHub Confirms Internal Repository Breach Tied to Malicious Nx Console Extension
Summary
GitHub confirmed an employee device compromised through a poisoned Nx Console VS Code extension led to a breach of internal repositories. TeamPCP reportedly exfiltrated about 3,800 repositories; GitHub rotated secrets and is monitoring for further activity.
Key points
- GitHub confirmed the breach stemmed from an employee device compromised through a malicious version of the Nx Console VS Code extension.
- TeamPCP reportedly exfiltrated about 3,800 internal repositories; the article does not establish that all repositories were independently verified as exfiltrated.
- Researchers said the extension stole credentials and sensitive data from developer services, including 1Password, npm, GitHub, and AWS.
- The trojanized extension was available on Visual Studio Marketplace for about 18 minutes on May 18, 2026.
- A researcher said the extension ran a shell command that downloaded and executed a hidden package from a planted commit in the official nrwl/nx repository.
- GitHub rotated critical secrets and is monitoring for follow-on activity. It said it had no evidence of impact to customer information stored outside its internal repositories.
- The incident was linked to the broader TanStack supply chain attack and prompted discussion among open-source maintainers about software supply-chain security.
Article Details
- Victim Organization
- GitHub
- Incident Type
- Breach of GitHub internal repositories following compromise of an employee device through a malicious Nx Console VS Code extension.
- Incident Date
- 2026-05-18
- Data Types Exposed
- Internal repository data
- Developer credentials reportedly harvested by the malicious extension
- Affected Records
- About 3,800 repositories were reportedly exfiltrated.
- Operational Impact
- GitHub said it contained the incident, rotated critical secrets, and is monitoring for follow-on activity. The article reports no evidence of impact to customer information stored outside GitHub's internal repositories.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed
MITRE ATT&CK
T1059.004 · Unix ShellThe extension reportedly ran a shell command on startup to download and execute a hidden package.T1105 · Ingress Tool TransferThe shell command reportedly downloaded a hidden package from a planted commit.T1195.001 · Compromise Software Dependencies and Development ToolsA malicious version of the Nx Console developer extension was distributed through the extension marketplace, consistent with compromise of a software dependency or development tool.T1555.005 · Password ManagersThe credential stealer reportedly harvested sensitive data from 1Password vaults.
People
Alexis WalesGitHub's Chief Information Security Officer; she provided GitHub's statement about the breach and the absence of evidence of impact to customer information outside internal repositories.Jeff CrossCo-founder of Narwhal Technologies, the company behind nx.dev; he commented on the incident's implications for securing developer tooling and open-source distribution.Nir ZadokOX Security researcher who described how the malicious extension reportedly ran a disguised shell command to download and execute a hidden package.Raphael SilvaAikido security researcher who discussed how automatic extension updates can expose users to releases from compromised publishers.
Threat Actors
Products
1PasswordThe malicious extension stole credentials from services like 1Password, npm, GitHub, and AWS.AWSThe malicious extension stole credentials from services like 1Password, npm, GitHub, and AWS.Claude Codedistribute a credential stealer capable of harvesting sensitive data from 1Password vaults, Anthropic Claude Code configurations, npm, GitHub, and Amazon Web Services (AWS).GitHubGitHub confirmed its internal repositories were breached through an employee device compromised by a poisoned Nx Console VS Code extension, linked to the broader TanStack supply chain attack.npmThe malicious extension stole credentials from services like 1Password, npm, GitHub, and AWS.Nx ConsoleGitHub confirmed its internal repositories were breached through an employee device compromised by a poisoned Nx Console VS Code extension, linked to the broader TanStack supply chain attack.VSCodeof a compromise of an employee device involving a poisoned version of the Nx Console Microsoft Visual Studio Code (VS Code) extension.