What Happened
GitHub confirmed on May 20, 2026 that roughly 3,800 internal repositories were exfiltrated after one of its employees installed a malicious version of the Nx Console VS Code extension. The compromised version — nrwl.angular-console v18.95.0, which appeared identical to the legitimate extension used by over 2.2 million developers — executed a multi-stage credential stealer immediately upon a developer opening any workspace.
The payload, analysed by StepSecurity, harvested authentication tokens from GitHub, npm, AWS, HashiCorp Vault, Kubernetes, and 1Password. It exfiltrated stolen secrets over three independent channels: HTTPS, the GitHub API, and DNS tunneling. The malicious version was live on the VS Code Marketplace for approximately 11 minutes before removal. TeamPCP claimed credit for the breach on cybercrime forums, offering the stolen GitHub source code for sale at $50,000. GitHub states no customer data outside its internal repositories was accessed, though the investigation continues.
The attacker gained VS Code Marketplace publishing credentials through a contributor’s GitHub personal access token stolen in an earlier supply chain incident. This is TeamPCP’s latest in a series of developer supply chain attacks following compromises of PyPI, npm, Docker Hub, Checkmarx, DAEMON Tools, and LiteLLM.
Why This Matters for Canadian Organizations
VS Code is the dominant code editor across Canadian software development teams, government digital services, and cloud-native operations. Extensions install silently and execute with the full privileges of the developer’s session. A developer running a compromised extension on a machine connected to AWS, Kubernetes, or internal GitHub Enterprise is providing an attacker with authenticated access to production infrastructure.
The Nx Console extension specifically targets teams building Angular and React applications at enterprise scale — the same stack used by many federal and provincial digital service teams, financial technology companies, and software vendors operating in Canada. Any developer who had version 18.95.0 installed — even briefly — should assume their GitHub tokens, npm publish keys, AWS access keys, and Kubernetes service account tokens are compromised.
For Canadian organizations, the OSFI Guideline B-13 obligation to monitor third-party software access paths applies directly here. PIPEDA breach notification obligations are triggered if personal data stored in connected systems was accessible during the exfiltration window. Given that the payload targeted 1Password vault contents, any secrets stored there for production systems warrant immediate rotation.
What to Do
Audit VS Code extension install history across all developer workstations for the presence of nrwl.angular-console version 18.95.0. Treat any machine where this version was installed as fully compromised. Rotate GitHub personal access tokens, npm tokens, AWS access keys, HashiCorp Vault tokens, Kubernetes service account tokens, and 1Password credentials stored on any affected device.
Review git commit history and CI/CD pipeline logs for unauthorized pushes or workflow modifications made between May 18 and May 20. Scan for unexpected outbound DNS traffic patterns and HTTPS connections to unfamiliar hosts from developer endpoints during that window. Enforce extension allowlisting in VS Code for high-privilege development environments.
Source: BleepingComputer
