A single compromised developer tool, live on the Visual Studio Code Marketplace for less than half an hour, gave hackers a backdoor into one of the world’s most critical software infrastructure platforms.
On May 18, 2026, a threat group known as TeamPCP — also tracked by researchers as UNC6780 — published a trojanized version of the widely-used Nx Console VS Code extension. The malicious build was available on the official Visual Studio Marketplace for just 18 minutes, from 12:30 p.m. to 12:48 p.m. UTC. In that narrow window, the payload silently executed on at least one GitHub employee’s development machine, setting off a breach that ultimately exposed approximately 3,800 of GitHub’s internal repositories.
The incident is one of the most striking examples yet of how the software supply chain has become the preferred attack surface for sophisticated cybercrime groups — and how even the most security-conscious organizations can find themselves vulnerable through tools they trust every day.
The Anatomy of an 18-Minute Attack
The compromised extension — nrwl.angular-console version 18.95.0 — is one of the most popular developer tools in the VS Code ecosystem, with more than 2.2 million installations. Nx Console provides an integrated GUI for managing Angular and monorepo workspaces, making it ubiquitous among enterprise development teams.
TeamPCP didn’t start with Nx. According to security researchers at OX Security and StepSecurity, the group first compromised credentials belonging to a legitimate Nx developer by exploiting an earlier supply chain attack targeting TanStack npm packages. With those developer credentials in hand, they published the poisoned version 18.95.0.
The payload was devastatingly thorough. Within seconds of a developer opening any workspace, the backdoored extension silently fetched and executed a 498 KB obfuscated JavaScript payload — cleverly hidden inside a dangling orphan commit in the official nrwl/nx GitHub repository, where it would appear to belong to the legitimate project. The credential stealer then went to work harvesting secrets from a wide range of sources: GitHub personal access tokens, npm authentication credentials, AWS configuration files, HashiCorp Vault secrets, Kubernetes cluster configurations, and 1Password vaults.
Exfiltration happened across three independent channels simultaneously — HTTPS, the GitHub API, and DNS tunneling — making it harder for network monitoring tools to detect. On macOS machines, the payload also installed a persistent Python backdoor that used the GitHub Search API as a covert command-and-control channel, receiving further instructions cryptographically signed with a 4096-bit RSA key.
GitHub’s Exposure: 3,800 Repositories
GitHub’s security team detected the breach on May 19, the day after the attack. By then, an employee’s development device had been compromised, and the attacker had used the harvested credentials to clone roughly 3,800 internal repositories. GitHub immediately began rotating critical secrets, isolating infected endpoints, and removing the malicious extension from the Marketplace.
The scope of what was taken is still being assessed, but the sheer breadth of GitHub’s internal codebase — which underpins the version control infrastructure used by over 100 million developers worldwide — makes the potential implications significant. TeamPCP reportedly listed the stolen data for sale on a criminal forum at an asking price exceeding $50,000 USD.
GitHub has not publicly disclosed which specific repositories were affected, citing the ongoing nature of the investigation.
TeamPCP: A Group Built for Supply Chain Warfare
TeamPCP is not a newcomer. Researchers tracking UNC6780 have linked the group to a series of high-profile software supply chain compromises over the past two years. Their previous targets include Aqua Security’s Trivy vulnerability scanner, CheckMarx’s KICS infrastructure-as-code tool, the LiteLLM AI middleware library, the Telnyx communications SDK, the TanStack data fetching library, and even MistralAI’s developer tooling.
The pattern is consistent: identify a trusted developer tool with broad adoption, compromise a maintainer’s credentials through another supply chain attack, publish a backdoored version, and exfiltrate developer secrets before the community notices. The group has refined this playbook to operate at extraordinary speed, recognizing that even minutes of exposure on a widely-used extension can be enough to compromise machines that auto-update.
In the Nx Console case, the broader developer community caught the malicious extension independently in approximately 11 minutes — faster than TeamPCP’s own timeline suggests they expected. But in that window, auto-update mechanisms on developer machines had already pulled the poisoned version down and executed it.
The VS Code Marketplace Problem
The incident has reignited a debate that the security community has been raising for years: the Visual Studio Code Extension Marketplace has over 60,000 published extensions and relies heavily on automated scanning, community reports, and publisher reputation to gatekeep malicious code. But as this attack demonstrates, an attacker who has already compromised a legitimate publisher’s account can bypass those controls almost entirely.
Unlike browser extension stores, which have faced intense regulatory scrutiny over malicious publisher behavior, the VS Code Marketplace has historically operated with relatively light-touch review processes. Security firms have published research showing that malicious extensions can stay live for days or weeks before being flagged — making TeamPCP’s 18-minute window surprisingly brief by historical standards, even if the damage was severe.
Microsoft, which owns both GitHub and the VS Code Marketplace, now faces uncomfortable questions about whether the same organization can effectively secure both the toolchain and the platform developers use to build on it.
What Developers Should Do Now
Security researchers are urging organizations to take several immediate steps in the wake of the breach. First, any developer who had Nx Console installed and auto-updated between 12:30 and 12:48 p.m. UTC on May 18, 2026 should assume credential compromise and rotate all developer secrets immediately — GitHub tokens, npm access tokens, AWS keys, and any other secrets stored in the IDE environment.
Second, security teams should audit VS Code extension auto-update policies. Disabling automatic updates and requiring manual review of extension updates in enterprise environments significantly reduces exposure to this class of attack.
Third, organizations should review their use of developer secret management practices. Secrets stored directly in IDE configuration files or shell environments — rather than managed through hardware-backed secret managers — are particularly vulnerable to this type of credential harvester.
The Nx team released remediated versions 18.100.0 and later to address the issue. Developers should verify they are running an updated, clean version and scan their systems for indicators of compromise published by StepSecurity and OX Security.
A Warning About the Developer Toolchain
The GitHub breach via a poisoned VS Code extension is a sobering reminder that the developer toolchain itself has become a primary attack surface. As organizations invest heavily in securing their applications and cloud infrastructure, the tools used to build those applications often receive far less scrutiny.
TeamPCP’s continued success across a string of high-profile supply chain attacks suggests that this threat actor — and others like them — have identified a highly repeatable and lucrative strategy. Until the marketplace infrastructure that governs developer tool distribution is fundamentally hardened, the question for most development organizations isn’t whether they will be targeted by a supply chain attack, but when.
For GitHub, an organization whose entire business is built on developer trust, this breach is more than a security incident. It is a test of the platform’s credibility — and a signal that even the custodians of the world’s code are not immune to the threats they work to help others prevent.
Sources: The Hacker News, Help Net Security, OX Security, StepSecurity, Infosecurity Magazine, Rescana, Hackread, Sophos
