Visual Studio Marketplace
Microsoft's official extension registry for Visual Studio Code, distributing over 50,000 extensions to developers globally.
Last refreshed: 29 May 2026 · Appears in 1 active topic
Why was a malicious VS Code extension live for only 18 minutes yet cause a major breach?
Timeline for Visual Studio Marketplace
Hosted trojanised Nx Console v18.95.0 for 18 minutes before removal
Cybersecurity: Threats and Defences: GitHub's own code cloned via add-on- How did the Visual Studio Marketplace allow a malicious extension to reach GitHub?
- The Marketplace lacked mandatory cryptographic code-signing for extensions, allowing a trojanised Nx Console build (v18.95.0) to be published and downloaded within 18 minutes on 18 May 2026 before removal.Source: GitHub incident disclosure / CISA AA26-148A
- Does Microsoft sign VS Code extensions on the Marketplace?
- As of the May 2026 GitHub breach, VS Code extensions on the Marketplace were not required to carry mandatory cryptographic code-signing anchored to verified publisher identity, creating the supply-chain gap exploited in the attack.Source: CISA / Microsoft security advisory
Background
The Visual Studio Marketplace became the vector for the May 2026 GitHub supply-chain breach when a trojanised build of the Nx Console extension (v18.95.0) was live on the platform for 18 minutes on 18 May 2026. During that window a GitHub employee installed the malicious version; it harvested developer secrets including 1Password vaults, GitHub tokens, AWS credentials and Claude Code configuration, and used them to clone approximately 3,800 GitHub internal private repositories. The incident exposed a publisher-verification gap in the Marketplace's extension-signing and Integrity-check pipeline.
The Visual Studio Marketplace is Microsoft's official distribution channel for extensions to Visual Studio Code, Visual Studio, and Azure DevOps. Launched in 2015 alongside VS Code, it hosts more than 50,000 extensions and serves hundreds of millions of downloads. Publishers upload extension packages; Microsoft runs automated scans but historically has not required cryptographic signing of every release or enforced two-person release approval. The VSIX package format used by VS Code extensions does not carry a mandatory code-signing chain anchored to the publisher's verified identity.
The 18-minute live window — brief enough to evade automated takedown but long enough for one high-value target to install — is consistent with supply-chain attack patterns seen in npm and PyPI poisoning campaigns. The incident accelerated internal Microsoft discussions about mandatory publisher signing and real-time Integrity verification for VS Code extensions, and CISA added CVE-2026-48027 (Nx Console) to KEV on 27 May 2026.
