Hackers Steal GitHub Tokens Through Malicious VS Code Extension That Remained Available for 18 Minutes
Malicious VS Code extension stole GitHub tokens for 18 minutes.
A malicious version of the Nx Console VS Code extension was available on the marketplace for 18 minutes, during which it stole GitHub tokens and other secrets from developers. This incident is part of a larger campaign by the financially motivated threat actor TeamPCP, which has previously compromised build systems and security tools like Trivy.
AI summary of the linked source. Not reviewed by an editor. How this works
Run GitHub?
Get an email when a new story names GitHub, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA threat actor published a trojanized version of the popular Nx Console VS Code extension to the official marketplace, where it remained available for 18 minutes — long enough to steal GitHub tokens and secrets from unsuspecting developers who installed or updated it. This incident illustrates how software supply chain attacks can bypass traditional defenses by weaponizing trusted distribution channels like official extension marketplaces. The financially motivated group TeamPCP has demonstrated a pattern of targeting developer tooling and build pipelines, making the entire software development lifecycle a high-value attack surface. Because developers inherently trust tools from official marketplaces, even a brief window of availability can result in significant credential theft with lasting consequences for downstream systems and codebases.
What helps against this
How we list vendors
- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — tpcp.tar.gz