United States traces GitHub breach to poisoned tool
Tap title to read story
On May 24, 2026, Microsoft-owned GitHub confirmed that an external threat group, identified as TeamPCP, compromised parts of its internal codebase through a software supply chain attack. According to GitHub and independent security researchers, the intrusion was traced to a malicious update of the widely used Visual Studio Code extension "Nx Console," which had about 2.2 million installations. The tainted extension, distributed through official channels, executed code on developers’ machines to exfiltrate GitHub session tokens, credentials, and configuration files. Using these stolen credentials, attackers accessed private repositories and pivoted into GitHub’s internal infrastructure. GitHub’s CISO said an internal investigation began immediately after detecting anomalous activity.
More context
Timeline
- Earlier in 2026, Nx Console widely adopted
- Earlier in 2026, attackers infiltrate extension project
- Earlier in 2026, poisoned Nx Console update released
- Earlier in 2026, developers install malicious extension update
- Earlier in 2026, payload exfiltrates GitHub access credentials
- Earlier in 2026, attackers pivot into GitHub infrastructure
- May 24 2026, GitHub confirms internal codebase compromise
- May 24 2026, CISO announces ongoing breach investigation
Why it matters
This breach affects your privacy and security. If you're a developer using GitHub, your code and credentials could be at risk. Check your extensions, especially Nx Console, for any suspicious updates. It's worth forwarding this to your coder friends.
JQJO Editorial Desk · Human reviewed · AI assisted. Report a correction.
