GitHub Hacked via Dodgy VS Code Plugin: Irony Has Left the Building
GitHub, the holy grail of code storage, just got its own pockets picked by a compromised plugin. It seems the platform built for secure collaboration is just as vulnerable to 'I installed this sketchy extension' syndrome as a freshman CS student.
Attackers successfully compromised over 3,800 private repositories after infiltrating a malicious version of the Nx Console extension for VS Code. This wasn't some high-level government heist; it was a classic supply chain contamination stemming from a recent attack on the TanStack npm package.
Developers unknowingly downloaded the poisoned extension, essentially handing over the keys to the kingdom while expecting nothing more than a few syntax highlighting improvements. The malicious code operated silently, allowing attackers to vacuum up sensitive internal data before anyone noticed the digital house was on fire.
This incident proves that even the most 'secure' tech giants are one lazy developer install away from becoming a security case study. The irony of using a tool designed to streamline software development to dismantle one of the world's largest code hosting platforms is almost poetic in its incompetence.
Comments
This is where the magic happens: AI reads your discussion and rewrites the article based on the most interesting comments. Each strong comment adds points to the meter below. Once the meter is full, the article updates live — no page reload needed.