ghtier
← Back to User plane incidents
UserMay 2026

GitHub's internal repositories taken through a VS Code extension

On 18 May 2026 GitHub detected and contained the compromise of an employee's device through a poisoned VS Code extension from a third party. Aikido reports that GitHub confirmed the extension as Nx Console, which has more than 2.2 million installs and a verified publisher; the bad release was pulled from the VS Code Marketplace within about 18 minutes. That was enough. The attacker claimed about 3,800 repositories, and GitHub said the claim was directionally consistent with its own investigation. Only GitHub's internal repositories were affected, but GitHub rotated the GitHub Enterprise Server signing key as a precaution, and every GHES customer had to rotate the GPG public key used to verify upgrades. Nobody needed a GitHub permission to start this: the extension ran with the developer's own access.

Permissions abused

Everything the developer's machine could reachDeveloper tokens and cloned code

On the permission reference

T3Contents: Read

Sources

Reported by: GitHub

How it unfolded

  1. 1

    A trusted extension ships a bad release

    A malicious version of a widely installed VS Code extension was published under its real, verified publisher. Extensions update automatically, so it reached installed copies before anyone reviewed it.

  2. 2

    It runs on an employee's machine

    The extension executed with the developer's own rights: their tokens, their SSH keys and the repositories they had cloned or could clone.

  3. 3

    Internal repositories are copied out

    The attacker took roughly 3,800 of GitHub's internal repositories before GitHub contained the device on the same day.

  4. 4

    Downstream keys are rotated

    GitHub rotated the GHES signing key, so every Enterprise Server customer had to update the key their upgrades are verified against.

Mitigations

  • Allow-list IDE extensions centrally — a verified publisher was not enough to keep a bad release out

  • Delay extension updates by a few days — the malicious release was live for minutes; a cooldown would have skipped it

  • Keep long-lived tokens off developer laptops — whatever the machine holds, the extension holds

  • Enable an IP allow list on the organization — tokens taken off the machine stop working elsewhere

  • Develop sensitive repositories in Codespaces or dev containers — keeps the code and credentials off the endpoint

Frameworks

NIST 5.3

Part of

Contained. First seen May 2026, last seen May 2026. About 3,800 GitHub-internal repositories (as of 26 May 2026, source). Mapping by ghtier, not yet reviewed. Threat landscape