Malicious Nx Console VS Code extension breached GitHub repos

A trojanized release of the Nx Console extension for Visual Studio Code harvested credentials and tokens from developer environments and was used to access multiple internal GitHub repositories, GitHub confirmed. Security teams detected unusual access patterns tied to actions performed by the extension and traced the activity to the compromised release.

GitHub removed the malicious package from the Visual Studio Marketplace and began revoking affected credentials and tokens to block further access. An internal incident response team is investigating which repositories and assets were accessed. The company notified partners and developers who may have been affected and advised them to rotate credentials and review account activity.

Users were instructed to uninstall any versions of Nx Console obtained during the period surrounding the compromise and to audit local development environments for signs of credential theft. Because developer workflows often store access tokens and authentication caches on local machines or in continuous integration environments, extensions with elevated file and process access can be used to move from a workstation into hosted repositories.

Security teams recommended checking token issuances, reviewing recent commits and pushes, revoking unused tokens and enabling multifactor authentication where available. Organizations are reviewing internal controls for granting extension permissions and increasing monitoring of developer workstations for unusual network or file activity.

Marketplace operators use code signing, publisher verification and automated scanning to reduce risk, while attackers have targeted widely used packages and publishers. GitHub is running a forensic review to map the attack timeline, identify the initial compromise vector and determine what data, if any, was permanently exfiltrated. The company has not released a full list of affected repositories or detailed technical indicators of compromise.

According to GitHub: “We removed the malicious package and are rotating credentials while we conduct a forensic review to understand the scope of the incident.” The investigation is ongoing and the company is coordinating with security partners to contain the breach.