3AUG

GitHub's own code cloned via add-on

4 min read

16:08UTC

A poisoned Nx Console extension sat on the VS Code Marketplace for 18 minutes, long enough for UNC6780 to steal one GitHub developer's tokens and clone roughly 3,800 internal repositories.

← Back to KEV deadlines fell from 14 days to three Jump to analysis ↓

TechnologyDeveloping

Key takeaway

A marketplace add-on live for 18 minutes was enough to clone 3,800 of GitHub's internal repositories.

A trojanised build of the Nx Console extension for Microsoft's Visual Studio Code (version 18.95.0) went live on the Visual Studio Marketplace at 12:30 UTC on Monday 18 May 2026 and was pulled 18 minutes later ¹. Nx Console is a widely used add-on for managing Nx monorepo build toolchains. A GitHub employee installed it inside that window. On startup the extension ran a Shell command that pulled a hidden payload from a planted commit on the official nrwl/Nx repository, then harvested secrets from the machine: 1Password vaults, Claude Code configuration, and npm, GitHub and AWS tokens ².

With those tokens the attacker, self-identifying as TeamPCP and tracked by the Google Threat Intelligence Group as UNC6780, cloned around 3,800 of GitHub's own internal private repositories and listed the haul for sale at $50,000 and up ³. GitHub confirmed the incident on 19 and 20 May and assessed that customer repositories, enterprise accounts and user data were not affected.

The trust boundary that failed is the editor's implicit permission to run code on install. Endpoint detection and response, the agent that watches laptops for malware, was never installed inside the code editor, and the network edge never watched it either. The trusted tool ran with the developer's own privileges, which is why one install swept up cloud tokens, a password manager vault and a code-assistant config at once. UNC6780 is the same cluster that cloned 300-plus Cisco repositories a fortnight earlier and part of the wider wave that hit SAP's npm packages, OpenVSX extensions and PyPI . The climb is deliberate: from a malicious package sitting in a registry, to a vendor's source, to the registry operator's own estate.

CISA added the underlying flaw, CVE-2026-48027 in Nx Console, to its Known Exploited Vulnerabilities catalogue on Wednesday 27 May, and issued Alert AA26-148A on Thursday 28 May ⁴. Extension allow-listing, and the question of how long a malicious build can sit in a marketplace before takedown, are now first-order controls rather than housekeeping.

Deep Analysis

In plain English

Visual Studio Code is the text editor most software developers use to write code. It supports small add-on programmes called extensions, installed in one click from an official marketplace run by Microsoft. Extensions run inside the editor with the same permissions as the developer's own account. On 18 May 2026, attackers published a corrupted version of a popular extension called Nx Console. When a developer at GitHub installed it, the extension quietly read every password and access token stored on that machine, including the keys to GitHub's own private code repositories, and sent them to the attackers. The attackers then used those keys to copy about 3,800 of GitHub's internal private code repositories before anyone noticed. CISA, the US government's cyber agency, formally listed the flaw on 27 May and set a 4 June patch deadline. GitHub confirmed on 19 May that no customer repositories or user data were accessed. The attack worked because the extension marketplace does not require publishers to prove that a new version came from their own verified build pipeline.

Deep Analysis

Root Causes

The VS Code Marketplace lacks mandatory code-signing or SLSA provenance attestation for extension releases. A publisher token, which controls the right to push new versions, is the only gate between a threat actor and 50,000-plus extensions reaching millions of developer workstations. Token theft via a supply-chain CVE upstream (in this case the Trivy CVE-2026-33634 credential harvest in March 2026 attributed to UNC6780) is sufficient to bypass every downstream content control.

IDE extensions run at install time with the full privileges of the developer's shell session. On a developer workstation, that session typically holds tokens for cloud providers, code repositories, password managers, and AI coding assistants simultaneously.

CISA Alert AA26-148A noted that the stolen credential set covered AWS, GitHub, npm, 1Password, and Claude Code configuration, a cross-platform credential harvest that would otherwise require four separate phishing campaigns. The trust model of the IDE runtime does not distinguish between a legitimate extension initialising its build toolchain and a malicious extension reading the entire credential store.

Microsoft verifies publisher identity once at Marketplace registration but does not re-verify each release submission against a signing key anchored to the publisher's build pipeline. Any subsequent version push requires only the matching publisher token, nothing more. This gap predates VS Code and persists because requiring pipeline-anchored signing would break the workflow of the roughly 50,000 community extensions published by solo developers who do not have reproducible CI pipelines.

Escalation

UNC6780 has now moved from poisoning package contents (SAP npm, March 2026) to cloning a vendor's source (Cisco, 11 May) to breaching the internal estate of the marketplace operator itself. Each step increases the attacker's access to future supply-chain leverage. The CISA KEV addition and AA26-148A alert represent the US government treating this as a live infrastructure threat rather than a vendor incident.

What could happen next?

Risk
UNC6780 now holds approximately 3,800 GitHub internal repositories whose contents may include further credential material, internal tooling, and infrastructure configuration that could enable follow-on attacks.
Short term · Assessed
Precedent
CISA Alert AA26-148A establishes the federal government's position that IDE extension allow-listing by hash is a required control for federal developer workstations, a standard that large private-sector contractors working on government programmes will be expected to adopt.
Medium term · Assessed
Opportunity
The incident accelerates commercial demand for SLSA-compliant build attestation and extension-signing tooling from vendors including StepSecurity, OX Security, and Chainguard, whose products address the publisher-verification gap the attack exploited.
Short term · Assessed

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: The April 2024 XZ Utils backdoor followed an almost identical structural path: a trusted open-source maintainer account was socially engineered over two years, malicious code was committed to a widely-depended-upon package, and the payload fetched a second stage at install time.

The key difference is that the XZ Utils compromise targeted a system-level compression library running as a privileged daemon, while Nx Console v18.95.0 targeted developer-workstation context, meaning the stolen artefacts were developer secrets rather than SSH keys.

Counter-parallel: The 2022 Codecov bash-uploader incident followed a different distribution path: attackers modified a hosted script rather than a versioned package, so the poisoned file was served to every CI pipeline that ran curl on the canonical URL. That incident exposed environment variables for roughly 29,000 customers before discovery.

Nx Console's 18-minute exposure window and single-developer installation produced a narrower victim count but higher per-victim yield, illustrating that dwell time and install count are not the primary blast-radius determinants when the target is a highly privileged developer at an infrastructure provider.

Consensus view: StepSecurity's 2024 research on VS Code Marketplace publisher verification found that any account holding a matching publisher token can push a new extension version without code-review gates, and that the marketplace's automated malware scan uses static signatures that miss obfuscated loaders.

Sophos's post-incident analysis of the Nx Console payload confirmed the malicious build fetched its second-stage script from the legitimate nrwl/Nx GitHub repository at install time, a technique that defeats both the marketplace scanner and most EDR tools because the outbound request looks like a normal developer-tooling initialisation.

Counter-view: OX Security's supply-chain research team argues that publisher-token theft, not a Marketplace design flaw, is the proximate cause: the same publisher-verification gap exists on npm and PyPI, and all three registries have declined to implement mandatory commit signing or SLSA provenance attestation on the grounds that build-pipeline diversity makes universal enforcement impractical. From this perspective, blaming the Marketplace model misframes where the actual control gap sits.

Key tension: Whether the structural fix for IDE extension trust sits at the registry layer (mandatory SLSA Level 3 attestation per extension release, as OX Security recommends) or at the enterprise deployment layer (allow-listing extensions by hash in VS Code's settings.json, as GTIG's AA26-148A advisory recommends for federal civilian agencies), since both addresses the same gap from opposite ends of the distribution chain.

First Reported In

Update #5 · GitHub's own code cloned via VS Code add-on

The Hacker News· 29 May 2026

Read original →

Causes and effects

Caused by

UNC6780 takes Cisco AI Defense source code

UNC6780 escalated from cloning 300+ Cisco repositories to breaching GitHub's own internal estate, climbing the supply chain from a vendor's source to the registry operator itself.

Occurred 11 May 2026

Read story →

Three supply-chain hits in thirteen days

The GitHub internal repository breach is the latest step in the same supply-chain wave that hit SAP npm packages, OpenVSX extensions and PyPI in the prior fortnight.

Occurred 29 Apr 2026

Read story →

This Event

GitHub's own code cloned via add-on

The actor has climbed from poisoning package contents to stealing source from a vendor to cloning the registry operator's own internal estate.

Led to

Attack worm kit now open-sourced freely

UNC6780's GitHub repository breach via the poisoned Nx Console extension established the supply-chain arc; the Shai-Hulud open-source release and Phantom Gyp variant are the next escalation of the same threat cluster's capability.

Occurred 3 Jun 2026

Read story →

Different Perspectives

Group-IB

Group-IB, headquartered in Singapore, documented on 19 March that The Gentlemen began inside Qilin's own affiliate programme and split from it over a payment dispute. Its analysis makes this window's leak-site tally readable as a fracture inside one ransomware operation rather than the arrival of an unknown crew.

ENISA

ENISA placed EU drinking water and wastewater in its cyber risk zone for the first time on 28 May, finding one in three water entities had never run a risk assessment. CISA's 30 July advisory to American operators reads as the operational sequel to a gap European regulators had already documented two months earlier.

House of Lords and NCSC

The Cyber Security and Resilience Bill sits at House of Lords committee stage, its amendment paper running to 23 July. Separately, the NCSC guidance CISA cited when directing water operators to disconnect controllers is version 1.0 from March 2024, a two-year-old British document doing operational work in an American alert published last week.

heise online

heise online reported on 27 July that Russian state attackers, named as APT28, ran the hotel WiFi credential-harvesting campaign. Its attribution is firmer than ReliaQuest's own hedged low-to-medium confidence assessment of the same intrusion, a difference in national reporting posture rather than a settled dispute over who is responsible.

CISA and ReliaQuest

CISA compressed remediation deadlines under BOD 26-04 while, in the same window, telling water and wastewater operators to disconnect internet-exposed controllers rather than patch them. ReliaQuest, investigating the hotel WiFi campaign, held its assessment of the intrusion route at low-to-medium confidence and declined to name a state sponsor.

AIVD

AIVD co-signed AA26-204A alongside CISA, the NSA and the FBI, adding its signature to the fifteen-agency coalition naming LAUNDRY BEAR. Dutch involvement continues a pattern of joint Five Eyes-adjacent advisories the agency has co-issued with CISA and NCSC through 2026.