An 18-Minute Window Was Enough. How a Malicious VS Code Extension Breached 3,800 GitHub Repos and Stole Claude Code Credentials.

On May 18, 2026, a malicious version of the Nx Console VS Code extension was live on the Visual Studio Marketplace for 18 minutes, between 12:30 p.m. and 12:48 p.m. UTC. One GitHub employee installed it during that window. The result: TeamPCP, the threat actor behind the attack, exfiltrated credentials from that employee's 1Password vault, Claude Code configuration, AWS tokens, and npm secrets, and used those credentials to access approximately 3,800 of GitHub's internal repositories.

GitHub confirmed the breach on May 19. Customer repository data was not affected. GitHub's internal source code and internal organization data was.

Eighteen minutes on a marketplace that processes millions of extension installs. That's the attack surface.

How the attack chain worked

This is a supply chain attack, meaning the malicious code didn't come from a phishing email or a compromised account. It came through a legitimate-looking developer tool update.

The Nx Console extension is widely used by developers working with Nx monorepos. TeamPCP (a cybercrime group that GitHub and security researchers have linked to earlier supply chain attacks targeting open-source AI middleware and the TanStack npm ecosystem) published a trojanized version under the same extension ID. The version passed whatever automated checks the VS Code Marketplace runs.

Once installed, the extension ran a credential stealer. The stealer specifically targeted 1Password vaults, Claude Code credential stores, npm authentication tokens, GitHub tokens, and AWS credentials. These are not generic targets: this is a list that reads like "what does a senior developer working with AI tools have on their machine."

The attack then used those exfiltrated credentials to access GitHub's internal infrastructure. TeamPCP subsequently listed "GitHub's source code and internal orgs" for sale on a cybercrime forum at a floor price of $50,000.

Why the VS Code Marketplace is a real risk right now

The VS Code Marketplace does not have a strong security model for extension updates. Extensions can push updates silently. Users who have automatic extension updates enabled (and many do, because who wants to manually update 40 extensions) will receive malicious versions without any prompt.

This is a structural problem that has existed for years, but it's getting materially worse as AI developer tools become high-value credential targets. A year ago, stealing a developer's environment meant getting AWS keys and maybe some GitHub tokens. Today, it means getting Claude Code API keys, Anthropic Platform credentials, and configurations that may include system prompts, client data context, and MCP tool definitions.

The attack surface for an AI developer is significantly larger than it was eighteen months ago. Every tool you've added to your workflow since then is a potential attack surface, and the VS Code extension ecosystem is the path of least resistance.

What you should do before tomorrow

I went through my own VS Code setup after reading this story, and there are a few things worth doing right now, not at some point, but this week.

First, audit your installed extensions. Go through the full list and remove anything you haven't actively used in the last 90 days. Extensions you're not using are attack surface you're carrying for no benefit.

Second, disable automatic extension updates. In VS Code settings, search for extensions.autoUpdate and set it to false or onlyEnabledExtensions. This means you'll have to manually approve updates, which is mildly annoying and materially safer.

Third, treat your Claude Code credentials like AWS root keys. The ~/.claude/ directory and the API keys stored in it are now known targets. Rotate your Anthropic API keys. Use separate API keys for different projects. Set spend limits on API keys so a compromised key can't run up $10,000 in inference charges before you notice.

Fourth, if you're using 1Password or another password manager with a browser extension or system integration, be aware that credential stealers target these specifically because they're a single point of failure for your entire credential set. Make sure you have MFA enabled and that you're reviewing your 1Password activity log.

The market for stolen AI developer credentials

TeamPCP's $50,000 asking price for GitHub's internal source code is high enough to suggest this isn't random opportunism: it's a targeted operation. The group specializes in open-source supply chain attacks, specifically targeting AI middleware and developer tooling. The choice to hit Nx Console, a tool heavily used by teams building with AI agent frameworks, is not a coincidence.

There is a market for AI developer credentials: competitor intelligence, API key abuse for free inference, MCP tool configuration data that reveals what systems your agents can access. The threat model for solo operators who build AI products has changed. You're no longer just protecting your app. You're protecting your entire development environment as a high-value credential store.

The honest counter-take

GitHub is a massive target and has resources to harden against supply chain attacks that most solo developers don't. The fact that TeamPCP needed to compromise a GitHub employee to get this far suggests the attack required significant reconnaissance and a specific opportunity: it wasn't a spray-and-pray credential harvest.

For a solo operator, the realistic threat is more diffuse: you're more likely to be a casualty of a broad credential sweep than a targeted attack. But that's small comfort if your Claude Code API key ends up being used to run $8,000 of inference on someone else's project.

The steps above take about an hour. The asymmetry is obvious.

Author

Lukas

@lukcombinator

Sources

• GitHub confirms breach of 3,800 repos via malicious VSCode extension (Bleeping Computer)
• GitHub Breached via VS Code Extension (Aikido Security)
• Hacker group hits 3,800 internal GitHub repositories via poisoned developer plugin (Tom's Hardware)
• GitHub Internal Repositories Breached via Malicious Nx Console VS Code Extension (The Hacker News)