Poisoned Nx Console extension stole GitHub tokens in 18 minutes
Original title: Hackers Steal GitHub Tokens Through Malicious VS Code Extension That Remained Available for 18 Minutes
TeamPCP claims about 3,800 internal repositories from one GitHub employee; GitHub says customer repositories were not affected.
A poisoned Nx Console build stayed on the Visual Studio Code Marketplace for about 18 minutes and could expose source code, cloud keys, and GitHub tokens on developer machines. BlackFog ties it to TeamPCP, which earlier hid credential stealers in Trivy after entering Aqua Security’s build systems in March 2026 and also hit Checkmarx KICS and LiteLLM. Stolen repositories were listed for at least $50,000, and some tokens were reused weeks later. Australian charges against two alleged members and a separate US indictment remain unproven.
Unconfirmed: TeamPCP’s figure of about 3,800 repositories is only called directionally consistent by GitHub, and the criminal allegations are unproven.
- Nx Console has more than 2.2 million installs across versions.
- The Trivy stealer checked runner memory and more than 50 paths for keys.
- Stolen data was packed as tpcp.tar.gz and sent to a lookalike Aqua domain.
- A fallback created a victim GitHub repository named tpcp-docs.
- Australian authorities charged two alleged members, ages 21 and 23, in August 2026.
Impact: GitHub tokens, cloud keys, source code, and internal repositories stolen
| Product | Affected |
|---|---|
| Nx Console | — |
| Aqua Security Trivy | — |
| LiteLLM | 1.82.7, 1.82.8 |
| Checkmarx KICS | — |
- 1.Pin full commit SHAs, use short-lived OIDC credentials, and delay extension updates.
- 2.If listed indicators appear, rotate exposed credentials and review logs for use.
- 3.Restrict public access to Docker APIs, Kubernetes, Ray dashboards, and Redis.
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1552.004 Private KeysT1041 Exfiltration Over C2 ChannelT1071.001 Web ProtocolsT1496 Resource Hijacking
- Vendors
- NxAqua SecurityCheckmarx
- Malware
- Mini Shai-Hulud
- Victims
- Aqua Security
- Organizations
- GitHubBlackFogFBIUS Department of Justice
- Countries
- AustraliaUnited States
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | checkmarx.zone | models[.]litellm[.]cloud Domain to check for in logs Domain checkmarx[.]zone Domain to check for in logs GitHub repository tpcp-docs F |
| domain | models.litellm.cloud | org Lookalike of Aqua’s real domain used for uploads Domain models[.]litellm[.]cloud Domain to check for in logs Domain checkmarx[.]zone Dom |
| domain | scan.aquasecurtiy.org | d bundle of stolen data created by the Trivy stealer Domain scan[.]aquasecurtiy[.]org Lookalike of Aqua’s real domain used for uploads Domain |
From the original article
4 min read at cybersecuritynews.com
A poisoned version of the popular Nx Console extension for Visual Studio Code stayed on the official VS Code Marketplace for only about 18 minutes. That was long enough for some developers to install it and hand over their secrets. The theft led to one of the most serious developer-tool breaches of 2026.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.