2026-05-28 · 2026-Q2
Nx Console Malicious VS Code Extension Leads to GitHub Repository Breach
Outside the model: Adjacent ecosystem Agent tooling was not the attack surface, so no layer applies.
- Fixable:
- Yes, vendor patch
- Vendor response:
- Unknown
- In the wild:
- Yes
Target
Poisoned Nx Console VS Code extension (malicious build delivered via auto-update) used to compromise a GitHub employee device
Impact
Unauthorized access to and exfiltration of internal GitHub source-code repositories after the trojanized IDE extension ran on the victim's machine
Root Cause
A prior Nx developer-system compromise let attackers push a trojanized extension build through the marketplace auto-update channel, abusing the trust developers place in recommended IDE extensions