GitHub Internal Repositories Stolen Through Poisoned Nx Console VS Code Extension

GitHub confirmed that attackers exfiltrated about 3,800 internal repositories after compromising an employee device with a trojanized Visual Studio Code extension, later identified in multiple reports as Nx Console 18.95.0. The company said the malicious extension was removed, the affected endpoint was isolated, critical secrets and credentials were rotated, and incident response, log analysis, and follow-on monitoring were launched. GitHub’s current assessment is that the intrusion was limited to GitHub-internal repositories, with no evidence that customer repositories, enterprise accounts, or data stored outside those repositories were broadly affected, though some internal repositories may contain limited customer-related support information.

The breach was widely attributed to TeamPCP (also tracked as UNC6780), which advertised the stolen source code and internal organizational data on cybercrime forums and leak sites for $50,000 to $95,000, threatening to publish it if unsold. Reporting tied the compromise to the broader TanStack supply-chain campaign and said the poisoned extension was briefly available on Visual Studio Marketplace and OpenVSX, carrying credential-stealing malware aimed at GitHub, npm, AWS, Kubernetes, 1Password, and other developer assets. GitHub later told GitHub Enterprise Server administrators to rotate GPG public keys as part of signing-key rotation, while government and industry alerts urged organizations to remove the malicious extension, rotate exposed developer credentials, and scrutinize CI/CD and repository activity for follow-on abuse.