GitHub Internal Repositories Breached via Malicious VS Code Extension
May 21, 2026 — GitHub confirmed unauthorized access to internal repositories after an employee installed a compromised version of the Nx Console extension for Visual Studio Code. The malicious extension reportedly exfiltrated credentials, allowing attackers to access sensitive code and data.
Key Details
The breach occurred when a developer inadvertently installed a tampered version of Nx Console, a popular open-source tool for managing monorepos. Security researchers identified the malicious payload, which silently harvested authentication tokens and environment variables.
GitHub has since revoked affected credentials and notified impacted teams. The company stated no customer data was exposed, but internal projects, including unreleased features and infrastructure configurations, were accessed.
Context
This incident follows recent breaches involving developer tools, including a GitHub employee device compromise that exposed thousands of private repositories. Security experts warn that malicious IDE extensions pose a growing threat, as they often request broad permissions.
Statements
A GitHub spokesperson said, “We are investigating the incident and have taken steps to prevent further access.” The Nx Console maintainers confirmed they did not distribute the malicious version and are working with GitHub to identify the source.
Next Steps
GitHub plans to release additional security guidelines for extension usage. Developers are advised to verify extension signatures and restrict permissions.
