GitHub’s confirmation that its internal repositories were breached through a malicious Nx Console VS Code extension is another warning that developer tooling has become a prime supply-chain attack vector. In this case, the compromise reportedly originated from a poisoned extension linked to the wider TanStack supply-chain attack, allowing attackers to exfiltrate around 3,800 internal repositories. GitHub has stated that there is no evidence so far of impact to customer repositories or customer information outside its internal repositories, but the incident still highlights how quickly trusted developer tools can become attacker delivery channels.

This incident is especially serious because developer environments often contain access tokens, cloud credentials, package manager secrets, build workflows, and internal documentation. The malicious extension was reportedly live for only 18 minutes, yet that was enough to distribute credential-stealing malware targeting GitHub, npm, AWS, 1Password, and other developer assets. That is the modern software supply chain in all its glory: one trusted extension, one short window, and suddenly everyone is rotating secrets like it’s a fire drill. 

Organizations should treat IDE extensions, package managers, CI/CD tokens, developer workstations, and repository access as critical security assets. Security teams should restrict unapproved extensions, disable unnecessary auto-updates where appropriate, enforce least privilege for developer tokens, monitor unusual repository access, rotate exposed credentials, and audit build pipelines for malicious changes. The broader lesson is simple: software supply-chain security is no longer just about checking dependencies. It is about controlling every tool, identity, update channel, and workflow that touches code before it reaches production.

GitHub on Wednesday officially confirmed that the breach of its internal repositories was the result of a compromise of an employee device involving a poisoned version of the Nx Console Microsoft Visual Studio Code (VS Code) extension. The development comes as the Nx team revealed that the extension, nrwl.angular-console, was breached after one of its developers' systems was hacked in the

Source: GitHub Internal Repositories Breached via Malicious Nx Console VS Code Extension via The Hacker News — published 21 May 2026.