Loading story…
BindsNET disclosed that clones of its repository executed malicious code between August 29 and September 2, 2026. Every branch, including master, contained a concealed Visual Studio Code task that could automatically run attacker-controlled code through VS Code task behavior when the repository was opened or its tasks were triggered.
The incident is tracked as GitHub Security Advisory GHSA-6f2q-w3r8-xxhj and has been associated publicly with VS Code and PolinRider. The available disclosure does not identify the attacker, payload, affected users, initial access method, or remediation; organizations that cloned BindsNET during the exposure window should treat affected workstations and development credentials as potentially compromised and investigate repository task configuration and execution activity.
Trace attribution and downstream blast radius.
2 events from the most recent confirmed update back to the earliest known activity.
Between August 29 and September 2, 2026, every branch of the BindsNET repository, including master, contained a hidden Visual Studio Code task designed to automatically execute attacker-controlled code when a repository clone was opened or triggered through VS Code task behavior.
BindsNET disclosed that malicious code executed on cloned repositories during the August 29–September 2 incident. The disclosure was documented as GitHub Security Advisory GHSA-6f2q-w3r8-xxhj.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GitHub confirmed that attackers exfiltrated about **3,800 internal repositories** after compromising an employee device with a trojanized Visual Studio Code extension, later identified in multiple reports as **Nx Console `18.95.0`**. The company said the malicious extension was removed, the affected endpoint was isolated, critical secrets and credentials were rotated, and incident response, log analysis, and follow-on monitoring were launched. GitHub’s current assessment is that the intrusion was limited to **GitHub-internal repositories**, with no evidence that customer repositories, enterprise accounts, or data stored outside those repositories were broadly affected, though some internal repositories may contain limited customer-related support information. The breach was widely attributed to **TeamPCP** (also tracked as **UNC6780**), which advertised the stolen source code and internal organizational data on cybercrime forums and leak sites for **$50,000 to $95,000**, threatening to publish it if unsold. Reporting tied the compromise to the broader **TanStack** supply-chain campaign and said the poisoned extension was briefly available on Visual Studio Marketplace and OpenVSX, carrying credential-stealing malware aimed at GitHub, npm, AWS, Kubernetes, 1Password, and other developer assets. GitHub later told **GitHub Enterprise Server** administrators to rotate GPG public keys as part of signing-key rotation, while government and industry alerts urged organizations to remove the malicious extension, rotate exposed developer credentials, and scrutinize CI/CD and repository activity for follow-on abuse.
Jun 29, 2026
A supply-chain compromise in the `react-tracked` GitHub repository led to attacker-controlled code execution during `npm install` after malicious commits briefly landed on the default branch. The implant added `src/install.js` and a `postinstall` hook that fetched and evaluated a remote JavaScript payload from an attacker-controlled HTTPS endpoint, disabled TLS verification, and avoided CI and cloud or serverless environments to focus on developer workstations. Although the tainted code was never published to npm and was later force-pushed away, any developer who installed from an affected checkout, fork, local clone, or direct commit reference may have been exposed; impacted systems should be treated as fully compromised and reachable credentials rotated. The incident fits a broader wave of developer-focused software supply-chain attacks that has intensified across GitHub, npm, PyPI, Docker Hub, and CI/CD environments. Recent reporting tied the March 2026 compromises of tools including Trivy, Checkmarx KICS, and LiteLLM to TeamPCP, a threat cluster Oligo Security says overlaps with the longer-running TA-NATALSTATUS and ShadowRay 2.0 activity through shared infrastructure, staging paths, and deployment scripts. Researchers say these campaigns increasingly abuse trusted developer platforms, steal tokens, and use malicious repositories, workflows, and packages to reach workstations and cloud-connected build environments.
Aug 12, 2026
Researchers reported that developer tooling can execute code from a project **before a user writes code or starts a build**, extending long-standing supply-chain concerns from package restore and project evaluation into newer coding-agent workflows. Datadog Security Labs described pre-prompt execution paths in trusted coding-agent projects, while separate research on NuGet and MSBuild showed that opening a repository or restoring dependencies can invoke `.targets` or `.props` logic and arbitrary commands through MSBuild's `Exec` task during project evaluation. The combined findings highlight a risk path in which a cloned or otherwise trusted repository can trigger automation in IDEs, agents, or CI/CD environments and expose sensitive credentials, tokens, and build secrets. Researchers noted that Visual Studio applies **Mark of the Web** warnings to downloaded files but not necessarily to repositories obtained via `git clone`, leaving a gap where malicious project metadata or package content may run without equivalent trust prompts; community discussion emphasized isolating untrusted projects in disposable VMs or tightly scoped rootless containers as a baseline mitigation.
Aug 4, 2026