A newly disclosed vulnerability in GitHub.dev and VS Code’s web-based environment shows how a single click could allow attackers to steal a user’s GitHub OAuth token. According to The Hacker News, researcher Ammar Askar found that an attacker could abuse GitHub.dev’s interaction with VS Code webviews to install a malicious extension and steal tokens that may have read and write access to repositories, including private repositories. ([The Hacker News][1]) 

Why This Is Serious 

GitHub.dev is designed to give developers a lightweight browser-based code editor. That convenience is useful, but this vulnerability shows the uncomfortable truth: when developer tools are connected to source code, OAuth tokens, extensions, and repositories, they become extremely attractive targets.

The issue reportedly involved malicious JavaScript running inside an untrusted webview, simulating keypresses, opening the Command Palette, and installing an attacker-controlled extension. That extension could then extract the GitHub OAuth token passed to GitHub.dev and use GitHub APIs to enumerate private repositories the victim could access. In other words, one innocent-looking click could become a supply-chain security problem. Because naturally, even “open in browser editor” now needs threat modeling. 

The Developer Risk 

Developers often have access to sensitive repositories, internal tools, deployment scripts, API keys, infrastructure code, and product secrets. If an attacker steals a developer’s GitHub token, the damage may go far beyond one account. It can lead to source code theft, malicious commits, poisoned dependencies, secrets exposure, or deeper compromise of the software delivery pipeline.

This is why developer identity and developer tooling must be treated as critical infrastructure. A developer workstation, browser-based editor, OAuth token, extension, and Git repository are not separate security problems. They are all part of the same attack surface, because attackers are sadly better at connecting dots than most quarterly risk reviews.

What Organizations Should Do 

Organizations should review GitHub OAuth permissions, limit token scopes, and avoid broad access wherever possible. Developers should be encouraged to review authorized applications and revoke anything unnecessary. Private repository access should follow least privilege, especially for contractors, temporary teams, and service accounts.

Security teams should also monitor GitHub activity for unusual repository enumeration, abnormal API usage, unexpected commits, new deploy keys, suspicious OAuth apps, and changes to workflows or CI/CD pipelines. Browser-based development environments should be assessed carefully, especially where extensions, webviews, and token handoff mechanisms are involved.

Where possible, organizations should enforce SSO, strong MFA, branch protection, signed commits, secret scanning, dependency review, and alerting for risky GitHub actions. These controls may sound boring, but so does “we lost our source code because someone clicked a link,” and yet here we are.

Final Comment 

This attack is a reminder that software supply-chain security does not begin only at build servers or package registries. It begins with developer identity, repository access, editor security, OAuth flows, and extension controls.

Developer tools are powerful because they sit close to source code and production workflows. That also makes them dangerous when abused. Organizations must secure the tools developers use every day, not just the applications they build. In modern attacks, stealing a token can be as damaging as exploiting a server, and one careless click can become the starting point for a much larger compromise.

Cybersecurity researchers have disclosed a one-click attack via Microsoft Visual Studio Code (VS Code) that makes it possible to steal a user's GitHub token. "Just by clicking a link, it's possible for an attacker to steal a GitHub token that can read and write to your repos, including private ones," security researcher Ammar Askar said. GitHub supports a feature called GitHub.dev that runs as

Source: One-Click GitHub Dev Attack Lets Attackers Steal Full GitHub OAuth Tokens via The Hacker News — published 03 Jun 2026.