[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$frNhWBJQqYOF4B4cTwiHUf3fZr4Pc_Thmhjp8a1sqIyQ":3},{"article":4,"iocs":55,"watch_terms":59,"solutions":60,"lesson":140},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"50aedd9b-542f-4eed-a931-d3a841e78bec","Hackers Steal GitHub Tokens Through Malicious VS Code Extension That Remained Available for 18 Minutes","hackers-steal-github-tokens-through-malicious-vs-code-extension-that-remained-av-80f389","A poisoned version of the popular Nx Console extension for Visual Studio Code stayed on the official VS Code Marketplace for only about 18 minutes. That was long enough for some developers to install it and hand over their secrets. The theft led to one of the most serious developer-tool breaches of 2026. The extension […] The post Hackers Steal GitHub Tokens Through Malicious VS Code Extension That Remained Available for 18 Minutes appeared first on Cyber Security News.","A malicious version of the Nx Console VS Code extension was available on the marketplace for 18 minutes, during which it stole GitHub tokens and other secrets from developers. This incident is part of a larger campaign by the financially motivated threat actor TeamPCP, which has previously compromised build systems and security tools like Trivy.","Malicious VS Code extension stole GitHub tokens for 18 minutes.","https:\u002F\u002Fcybersecuritynews.com\u002Fhackers-steal-github-tokens\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FHackers-Steal-GitHub-Tokens-Through-Malicious-VS-Code-Extension-That-Remained-Available-for-18-Minutes.webp","2026-11-10T09:54:32+00:00","2026-11-10T10:00:40.674163+00:00",8,[17,20,23,26,28,30],{"name":18,"type":19},"TeamPCP","threat_actor",{"name":21,"type":22},"Nx Console","product",{"name":24,"type":25},"GitHub","vendor",{"name":27,"type":22},"Visual Studio Code",{"name":29,"type":22},"Trivy",{"name":31,"type":25},"Aqua Security","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":32,"icon":34,"name":35,"slug":36},null,"Supply Chain","supply-chain",[38,43,45,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56],{"type":49,"value":57,"context":58},"tpcp.tar.gz","Payload archive name used by TeamPCP",[24,31,21],{"controls":61,"vendors":136},[62,90,116],{"slug":63,"name":64,"problem":65,"products":66},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[67,75,82],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"vendor_slug":76,"vendor_name":24,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"github","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"slug":91,"name":92,"problem":93,"products":94},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[95,100,108],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":96,"product_name":97,"url":98,"description":99},"cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"slug":117,"name":118,"problem":119,"products":120},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[121,127,135],{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":122,"product_name":123,"url":125,"description":126},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",{"vendor_slug":76,"vendor_name":24,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},[137],{"slug":76,"name":24,"logo_path":77,"roles":138},[139],"affected",{"slug":141,"title":142,"body":143,"framework_refs":144,"framework_notes":152},"malicious-vs-code-extension-steals-github-tokens-in-18-minute-window","Malicious VS Code Extension Steals GitHub Tokens in 18-Minute Window","A threat actor published a trojanized version of the popular Nx Console VS Code extension to the official marketplace, where it remained available for 18 minutes — long enough to steal GitHub tokens and secrets from unsuspecting developers who installed or updated it. This incident illustrates how software supply chain attacks can bypass traditional defenses by weaponizing trusted distribution channels like official extension marketplaces. The financially motivated group TeamPCP has demonstrated a pattern of targeting developer tooling and build pipelines, making the entire software development lifecycle a high-value attack surface. Because developers inherently trust tools from official marketplaces, even a brief window of availability can result in significant credential theft with lasting consequences for downstream systems and codebases.",[145,146,147,148,149,150,151],"MITRE ATT&CK T1566: Phishing","CIS Control 7: Continuous Vulnerability Management","CIS Control 14: Security Awareness and Skills Training","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":153,"MITRE ATT&CK T1566: Phishing":154,"OWASP A06:2021 Vulnerable and Outdated Components":155,"CIS Control 7: Continuous Vulnerability Management":156,"CIS Control 14: Security Awareness and Skills Training":157,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":158,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":159},"NIS2 requires supply chain security measures including assessment of risks introduced by suppliers and service providers, which applies directly to the use of third-party extensions in developer environments.","TeamPCP used a trojanized legitimate extension as a lure — a supply-chain variant of phishing — to trick developers into installing malware through a trusted channel, making awareness of this technique critical for defense.","The attack exploited developer trust in third-party components from an official marketplace; this OWASP risk category highlights the danger of using unverified external components without integrity checks.","Continuously monitoring software supply chain components, including third-party IDE extensions, for newly introduced malicious versions would have flagged the tampered Nx Console extension before widespread installation.","Developers who understand supply chain attack techniques and extension vetting practices are less likely to install unverified extensions, reducing the attack surface exploited in this campaign.","This control requires organizations to track and assess vulnerabilities in software they use, including third-party tools and extensions, which would prompt proactive vetting of marketplace extensions before deployment.","Proper scoping and short-lived rotation of GitHub tokens would have limited the value of stolen credentials, reducing the blast radius of token exfiltration by the malicious extension."]