GitHub Internal Repositories Breached via Malicious Nx Console VS Code Extension
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-45321 | Supply chain compromise: credential-stealing code in 42 @tanstack/* npm packages CVE-2026-45321 is a supply chain compromise in which 84 malicious versions across 42 @tanstack/* npm packages (including @tanstack/react-router, @tanstack/react-start, @tanstack/history, and related router/start packages) were published to the npm registry on 2026-05-11 between roughly 19:20 and 19:26 UTC, authenticated through TanStack's legitimate GitHub Actions OIDC trusted-publisher binding. The attacker chained three known weakness classes — a pull_request_target 'Pwn Request' misconfiguration, GitHub Actions cache poisoning across the fork-to-base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — allowing publication under a trusted identity without modifying the publish workflow. Each affected package received exactly two malicious versions carrying credential-stealing malware, so developers, CI pipelines, or downstream builds that installed them could have npm, GitHub, and cloud credentials extracted; related reporting (FBI, StepSecurity) links the campaign to stolen cloud credentials and a self-spreading 'Mini Shai-Hulud' worm that also hit packages in other ecosystems such as Mistral AI and Guardrails AI. Exposure is limited to consumers who installed the two malicious versions published per package during the exposure window; other users of these widely deployed libraries were not affected by the malicious publishes. Exploitation is confirmed in the wild: the issue was added to CISA's Known Exploited Vulnerabilities catalog on 2026-05-27 with known ransomware use, and EPSS estimates a 2.3% probability of exploitation in the next 30 days (83rd percentile). Do: Audit lockfiles and CI logs for the affected @tanstack/* packages' versions published during the 2026-05-11 ~19:20-19:26 UTC window; if found, reinstall from clean versions per the TanStack postmortem (tanstack.com/blog/npm-supply-chain-compromise-postmortem) and rotate exposed credentials (npm tokens, GitHub PATs/secrets, cloud keys), treating any cached CI artifacts as suspect. Apply mitigations per vendor instructions and CISA BOD 22-01 guidance for cloud services, or discontinue use if mitigations are unavailable, and remediate the underlying CI weaknesses (pull_request_target handling, Actions cache hygiene, and OIDC token handling) to prevent recurrence. | 9.6 | 2% | KEV ransomware PoC ×2 |
| large~100,000+ downstream installs/CI runs (estimate) | |
| CVE-2026-48027 | Malicious Code Embedded in Nx Console VS Code Extension 18.95.0 CVE-2026-48027 is a supply-chain compromise in which version 18.95.0 of Nx Console, the Visual Studio Code UI for the Nx and Lerna build tools, was published with embedded malicious code (CWE-506). The compromised release was live on the Visual Studio Marketplace for roughly 18 minutes (12:30-12:48 UTC) and on OpenVSX for about 36 minutes (12:33-13:09 UTC) on 19 May 2026, so developers whose clients pulled the update during those windows had the malicious extension installed. An attacker gains code execution on developer workstations and used it to steal cloud and CI credentials; the compromise has been tied to a breach of GitHub internal repositories and is associated with ransomware activity. Only users who installed Nx Console 18.95.0 are affected, and version 18.100.0 is not compromised. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 27 May 2026 with known ransomware use, and public analysis is available from StepSecurity. Do: Upgrade to Nx Console 18.100.0 immediately; if 18.95.0 was installed on 19 May 2026, treat local secrets as compromised and rotate GitHub tokens, cloud and CI credentials, npm tokens, and SSH keys on affected machines, and review repositories and pipelines for tampering. Follow CISA KEV/BOD 22-01 required actions and review the StepSecurity blog post for indicators of compromise. | 9.3 | 2% | KEV ransomware PoC |
| moderatelikely tens of thousands of developer workstations (the subset of Nx Console's roughly one-million-install developer base whose clients auto-updated to 18.95.0… |
Full article695 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananMay 21, 2026Supply Chain Attack / Developer Tools
GitHub on Wednesday officially confirmed that the breach of its internal repositories was the result of a compromise of an employee device involving a poisoned version of the Nx Console Microsoft Visual Studio Code (VS Code) extension.
The development comes as the Nx team revealed that the extension, nrwl.angular-console, was breached after one of its developers' systems was hacked in the wake of the recent TanStack supply chain attack. Other companies that were impacted by the TanStack compromise include OpenAI, Mistral AI, and Grafana Labs.
"We have no evidence of impact to customer information stored outside of GitHub's internal repositories, such as our customer's own enterprises, organizations, and repositories," Alexis Wales, Chief Information Security Officer of GitHub, said in a statement.
"Some of GitHub's internal repositories contain information from customers, for example, excerpts of support interactions. If any impact is discovered, we will notify customers via established incident response and notification channels."
The attack is said to have allowed the threat actor, a cybercriminal group known as TeamPCP, to exfiltrate about 3,800 repositories. GitHub said it has taken steps to contain the incident and rotated critical secrets, adding it's continuing to monitor the situation for follow-on activity.
In a post on X, Jeff Cross, co-founder of Narwhal Technologies, the company behind nx.dev, said, "this incident highlights that there need to be deeper, more fundamental changes to how we and other maintainers need to think about securing developer tooling and open source distribution."
"We're also beginning conversations with other high-profile open source maintainers about how we can work together on some of the deeper structural problems around software supply chain security. A lot of the assumptions the ecosystem has operated under for years no longer hold."
In recent months, TeamPCP has rapidly gained notoriety for large-scale software supply chain attacks, specifically going after widely-used open-source projects and security-adjacent tools that developers rely on.
What's notable here is that the trojanized version of the VS Code extension was live on Visual Studio Marketplace only for 18 minutes (between 12:30 p.m. and 12:48 p.m. UTC on May 18, 2026). But this short window was enough for the attackers to distribute a credential stealer capable of harvesting sensitive data from 1Password vaults, Anthropic Claude Code configurations, npm, GitHub, and Amazon Web Services (AWS).
"The extension looked and behaved like normal Nx Console, but on startup it silently ran a single shell command that downloaded and executed a hidden package from a planted commit on the official nrwl/nx GitHub repository," OX Security researcher Nir Zadok said. "The command was disguised as a routine MCP setup task so it would not raise suspicion."
The interlinked nature of modern software has allowed TeamPCP to unleash a self-sustaining cycle of new compromises. The pattern that drives home this aspect is deceptively simple as it's nefarious: break into one trusted tool, steal credentials from developer systems that may install it, and use those credentials to break into the next legitimate tool.
"Every popular extension marketplace ships with auto-update on by default. VS Code, Cursor, the whole lineup," Aikido security researcher Raphael Silva said. "The reasoning makes sense in isolation, because most developers never update anything manually, so leaving it off means a long tail of editors running stale, vulnerable code."
"The trade-off stops making sense once you account for hostile/compromised publishers. Auto-update gives an attacker who controls a release a direct push channel into every machine running that extension. Marketplaces don't impose any review gate or waiting period between when an update is published and when installed clients pull it in."
Update
The supply chain attacks targeting TanStack and Nx Console are being tracked as CVE-2026-45321 (CVSS score: 9.6) and CVE-2026-48027 (CVSS score: 9.3), respectively.
On May 27, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added both the flaws to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply necessary fixes by June 10, 2026.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/05/github-internal-repositories-breached.html