[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fDvrSapjZ843S_sI55wXE6K9dBrseOKSTarSByz6SUgA":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"d5a69788-cced-4797-8b7b-7e03a25b9c15","malicious-vs-code-extension-steals-github-tokens-in-18-minute-window","50aedd9b-542f-4eed-a931-d3a841e78bec","Malicious VS Code Extension Steals GitHub Tokens in 18-Minute Window","A threat actor published a trojanized version of the popular Nx Console VS Code extension to the official marketplace, where it remained available for 18 minutes — long enough to steal GitHub tokens and secrets from unsuspecting developers who installed or updated it. This incident illustrates how software supply chain attacks can bypass traditional defenses by weaponizing trusted distribution channels like official extension marketplaces. The financially motivated group TeamPCP has demonstrated a pattern of targeting developer tooling and build pipelines, making the entire software development lifecycle a high-value attack surface. Because developers inherently trust tools from official marketplaces, even a brief window of availability can result in significant credential theft with lasting consequences for downstream systems and codebases.","**Immediate actions:**\n- Audit all installed VS Code extensions against their known-good publisher identifiers and version hashes, and remove any unverified or suspicious entries.\n- Rotate all GitHub tokens, API keys, and secrets stored in developer environments that may have been exposed during the incident window.\n- Report the malicious extension to the marketplace provider and verify it has been fully removed and flagged.\n\n**Long-term improvements:**\n- Establish an approved extension allowlist policy so developers may only install extensions vetted and approved by the security team.\n- Integrate secrets scanning tools (e.g., GitGuardian, Trufflehog) into CI\u002FCD pipelines to detect and alert on any leaked tokens before they reach production.\n- Store sensitive credentials in a dedicated secrets manager (e.g., HashiCorp Vault, AWS Secrets Manager) rather than in environment variables or local configuration files accessible to extensions.\n\n**Detection measures:**\n- Deploy endpoint monitoring capable of detecting unusual outbound network calls from IDE processes, which can surface data exfiltration by malicious extensions.\n- Subscribe to security advisories and threat feeds for developer tooling (VS Code marketplace, npm, PyPI) to receive rapid notification of compromised packages.\n- Implement SIEM alerting on GitHub token usage anomalies, such as authentication from unexpected IP addresses or geographic regions, to detect stolen credential abuse quickly.",[12,13,14,15,16,17,18],"MITRE ATT&CK T1566: Phishing","CIS Control 7: Continuous Vulnerability Management","CIS Control 14: Security Awareness and Skills Training","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":20,"MITRE ATT&CK T1566: Phishing":21,"OWASP A06:2021 Vulnerable and Outdated Components":22,"CIS Control 7: Continuous Vulnerability Management":23,"CIS Control 14: Security Awareness and Skills Training":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"NIS2 requires supply chain security measures including assessment of risks introduced by suppliers and service providers, which applies directly to the use of third-party extensions in developer environments.","TeamPCP used a trojanized legitimate extension as a lure — a supply-chain variant of phishing — to trick developers into installing malware through a trusted channel, making awareness of this technique critical for defense.","The attack exploited developer trust in third-party components from an official marketplace; this OWASP risk category highlights the danger of using unverified external components without integrity checks.","Continuously monitoring software supply chain components, including third-party IDE extensions, for newly introduced malicious versions would have flagged the tampered Nx Console extension before widespread installation.","Developers who understand supply chain attack techniques and extension vetting practices are less likely to install unverified extensions, reducing the attack surface exploited in this campaign.","This control requires organizations to track and assess vulnerabilities in software they use, including third-party tools and extensions, which would prompt proactive vetting of marketplace extensions before deployment.","Proper scoping and short-lived rotation of GitHub tokens would have limited the value of stolen credentials, reducing the blast radius of token exfiltration by the malicious extension.","published","2026-11-10T10:20:46.659878+00:00","2026-11-10T10:20:46.645+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fcybersecuritynews.com\u002Fhackers-steal-github-tokens\u002F","hackers-steal-github-tokens-through-malicious-vs-code-extension-that-remained-av-80f389","Hackers Steal GitHub Tokens Through Malicious VS Code Extension That Remained Available for 18 Minutes",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":42,"name":43,"slug":44,"description":45,"color":46},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[49,53,57],{"slug":50,"name":51,"problem":52},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"slug":54,"name":55,"problem":56},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":58,"name":59,"problem":60},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]