How a VS Code Extension That Was Live for Just 18 Min Handed Attackers 3,800 of GitHub’s Internal Repos!

A developer working at GitHub Company opens VS Code on a normal workday.

They spend the next few hours coding.

Some updates happen in the background.

Nothing looks unusual. The developer keeps coding.

And that’s it.

A few hours later, GitHub’s internal code gets stolen using developers machine and attacker puts it for sale.

Most developers think compromise looks obvious.

A suspicious binary. A fake login page. A weird email attachment.

But increasingly, modern attacks don’t look malicious at all.

They look like a routine update.

1. Attacker compromises an open source library named TanStack > A developer working at Nx Console (a popular VS Code extension) using TanStack gets compromised.
   

2. That developer had write access to Nx Console extension publishing > Attacker steals their credentials.
   

3. Attacker publishes a poisoned version of Nx Console extension to Visual Studio Marketplace > It silently runs a single shell command disguised as a routine MCP setup task > Steals credentials.
   

4. 18 min later, the Nx team detects the malicious version > Even pulls it from the marketplace.
   

5. But here’s the interesting detail: VS Code auto-updates extensions silently by default > Every developer who had Nx Console installed and opened VS Code during that 18-min window received the malicious version automatically > The update happened in the background while they worked.
   

6. One GitHub employee had this extension > their creds got stolen > attacker accesses GitHub's internal environment > Clones approximately 3,800 private repositories containing GitHub's own source code > Publishes it for sale.

If you’re interested to understand how TanStack itself got hacked, I wrote about it last week in the post here:

1. If you noticed, the extension was disguised as a routine “MCP task”. Attackers have realised that developers are currently flooded with AI-tool setups and are conditioned to click "Allow" on MCP prompts. Attackers are now exploiting AI-tool fatigue as an attack surface.
   

2. Auto-update is supposed to be a security feature. It keeps developers protected from vulnerabilities in outdated software. This attack inverts that entirely. The same silent, trusted mechanism designed to push security fixes pushed malicious code into hundreds of thousands of developer environments in under 18 minutes, with no prompt, no review, and no way for the recipient to know it happened. The feature worked exactly as designed. That’s what made it dangerous.
   

3. AI coding assistant configs are now high-value targets. The payload specifically targeted Claude Code configurations and related AI-tool setups because these tools increasingly hold privileged access to source code, CI/CD pipelines, cloud credentials, signing keys, and internal infrastructure. Attackers are treating AI tooling as critical infrastructure.
   

4. A developer workstation is now a control plane. A modern developer laptop contains GitHub access, cloud credentials, deploy tokens, production secrets, AI assistants, and signing infrastructure. All in one place. Compromising one developer environment today can provide more operational leverage than compromising dozens of traditional endpoints individually.
   

5. A lot of security assumptions we hold about our ecosystem are no longer true. The assumption that verified publisher status means trustworthy. The assumption that auto-update is net positive. The assumption that a popular extension with millions of installs is safe to have silently update in the background. Each of these assumptions was reasonable when the ecosystem was smaller and less targeted. None of them are safe to hold today.

If you write code today, your workstation likely contains cloud credentials, SSH keys, API tokens, CI/CD access, signing certificates, and increasingly, AI coding assistant configurations.

In other words, your laptop is no longer just a laptop.

It has quietly become a control plane for production infrastructure.

Attackers understand this very well.

If they can get a foothold on one of your machines, they can use that to jump into production.

You could argue that this has always been true. And yes, to some extent, it has.

But something important is changing:

Why break through hardened perimeter defenses when you can quietly ride trusted workflows already connected to everything?

This is why developer toolchains are now the real attack surface.

And to protect your company, you need to protect this entire ecosystem.