One Poisoned Extension Reached 3,800 of GitHub’s Internal Repositories
A poisoned Visual Studio Code extension compromised a GitHub employee device and enabled the theft of roughly 3,800 internal repositories. The incident turns a familiar developer convenience into the central security boundary: an editor extension can execute with the user’s access to source code, tokens, command-line sessions, and local credentials.
GitHub said it detected and contained the intrusion on 18 May 2026. It removed the malicious extension version, isolated the endpoint, began rotating critical secrets, and investigated follow-on activity. The attacker’s estimate of about 3,800 exfiltrated repositories was directionally consistent with GitHub’s findings.
The poisoned component was Nx Console version 18.95.0, tracked as CVE-2026-48027. It was available in the Visual Studio Marketplace for about 18 minutes and in OpenVSX for about 36 minutes. Automatic extension updates meant a short publication window could still execute code on machines where the legitimate extension was already installed.
The extension was the delivery path, not the final target
The malicious release fetched an obfuscated payload that harvested credentials from disk and memory. The Nx advisory lists GitHub tokens, Actions secrets, npm credentials, AWS metadata and secrets, Vault tokens, Docker and Google Cloud credentials, private keys, connection strings, and active 1Password command-line sessions among its targets.
That collection strategy explains how one compromised developer endpoint can expose far more than the files stored locally. A developer’s machine is often a junction between source-control access, cloud credentials, package publishing, CI/CD automation, and production troubleshooting. Malware does not need to break every service independently if the authenticated user already has the keys.
Nx said the malicious version recorded only 28 Marketplace downloads and 41 OpenVSX downloads. Its own telemetry, however, registered approximately 6,000 Visual Studio Code activations and one Cursor activation. The difference highlights a measurement problem in extension incidents: store download counters may not capture the reach created by background updates and already-running editors.
GitHub’s internal code was exposed, not every customer repository
GitHub said it had no evidence that the incident affected customer information stored outside its internal repositories, including customers’ own enterprises, organizations, and repositories. That boundary is important. The public evidence did not show a platform-wide customer repository breach.
The internal-repository scope was still significant. GitHub acknowledged that some internal repositories can contain customer information, such as excerpts from support interactions. It said affected customers would be notified if the investigation found an impact.
On 26 May, GitHub took an additional precaution and rotated the GitHub Enterprise Server signing key. Enterprise Server administrators were required to install the new public key before future upgrades could be verified. GitHub said the existing binaries it hosted remained valid and that GitHub Enterprise Cloud customers did not need to act on the key change.
The remediation is larger than uninstalling one extension
Organizations that ran Nx Console 18.95.0 should update to version 18.100.0 or later, terminate the documented cat.py and __DAEMONIZED processes, remove persistence artifacts, and rotate every credential reachable from the affected machine. The extension actively attempted to exfiltrate credentials, so a clean endpoint alone does not invalidate what may already have been copied.
The investigation should cover developer-account logs, repository cloning, GitHub CLI activity, package-registry publishing, cloud control-plane access, CI/CD workflows, and unusual DNS or HTTPS exfiltration. Secret rotation needs an owner and a validation step. A token that is changed in one system but remains embedded in another can preserve the attacker’s route.
The broader control is extension governance. Enterprises should inventory installed developer extensions, restrict approved publishers and versions where practical, monitor background updates, separate high-risk administrative credentials from day-to-day development sessions, and reduce the default scope of repository and cloud tokens.
The BlackTree angle is not that one employee installed the wrong plugin. Nx Console was a legitimate and widely used extension whose release path was compromised. The incident shows that developer tooling belongs inside the software-supply-chain threat model, with the same controls applied to packages, build actions, and deployment automation.
Sources: GitHub’s incident update, initially published 20 May 2026 and updated 26 May 2026; Nx Console security advisory, published 18 May 2026 and updated through 22 May 2026; CISA supply-chain bulletin; TechCrunch, published 20 May 2026 at 6:25 a.m. PDT. Initial source times were not provided where only a date is shown.
