GitHub Breach: A Poisoned VS Code Extension Led to Stolen Internal Repositories, How Trivy and LiteLLM Fit In, and What to Check This Week

GitHub says a poisoned VS Code extension on one employee's device gave attackers a way to copy GitHub's own internal code repositories. The attackers claim they took about 3,800. The same thing can happen at your company: if your developers, contractors or IT staff install editor extensions and build tools that nobody checks, that path leads to your cloud accounts, your servers and your website's code.

What happened in the GitHub breach

On Monday, May 18, 2026, GitHub detected and contained a compromise of an employee device. GitHub says the cause was a "poisoned VS Code extension" published by a third party, and its post links that phrase to the Nx Console security advisory. GitHub removed the extension version, isolated the device and started rotating its most important secrets first.

In its May 20 statement GitHub said the activity "involved exfiltration of GitHub-internal repositories only." On May 26 it added an update for GitHub Enterprise Server (GHES) customers: future GHES releases will be signed with a new key, so administrators must rotate the GPG public keys on their instances. If they don't, upgrades will fail with "Error: The file provided is not a valid GitHub Enterprise Server package."

What is confirmed and what is only claimed

How a VS Code extension got onto the laptop

The extension was Nx Console (extension ID nrwl.angular-console), a widely used helper for the Nx build system. Nx's advisory (CVE-2026-48027, rated critical) says version 18.95.0 went live on the Visual Studio Marketplace at 12:30 UTC on May 18 and came down at 12:48 UTC, about 18 minutes later. On Open VSX, the extension store used by some VS Code forks, it was up for about 36 minutes.

Nx's postmortem explains how it got there. The attacker published it as a legitimate Nx core contributor, using a GitHub CLI login token that malware from an earlier compromise of the TanStack packages had stolen seven days before. Microsoft's automated checks did not block the upload.

The Marketplace counted 28 installs and Open VSX counted 41 downloads. Nx's own telemetry showed about 6,000 extension activations, a gap Nx says it is still working out with Microsoft. Nx tells anyone who installed 18.95.0, or who had auto-update turned on during that window, to treat the machine as possibly compromised.

Once active in VS Code or forks such as Cursor, the payload installed persistence (a Python backdoor, a macOS LaunchAgent, and the Bun runtime on Windows). It then collected credentials for GitHub, npm, AWS, Google Cloud, HashiCorp Vault, 1Password, Docker, SSH keys and .env files, and sent them out over HTTPS, the GitHub API and DNS.

The chain behind it: Trivy, LiteLLM and TanStack

The GitHub breach was the latest step in a run of attacks on developer tools in 2026:

• Trivy, March 19: Aqua Security's advisory (CVE-2026-33634) says attackers used stolen credentials to publish a malicious Trivy v0.69.4. They also repointed 76 of 77 version tags in the trivy-action GitHub Action and all 7 tags in setup-trivy. Malicious Docker Hub images 0.69.5 and 0.69.6 followed on March 22. Aqua says this continued a late-February attack and that its credential rotation after the March 1 disclosure was not complete.
• LiteLLM, March 24: Malicious LiteLLM 1.82.7 and 1.82.8 were uploaded straight to PyPI. LiteLLM's tracking issue says the maintainer's account was hijacked by an attacker calling itself teampcp, and the team said the compromise came from its Trivy security scan dependency.
• TanStack, May 11: GitHub's advisory lists 84 malicious versions across 42 @tanstack packages. This is the malware that stole the token later used to publish Nx Console 18.95.0.

Trivy's malware fell back to creating repositories named tpcp-docs, and the LiteLLM attacker used the name teampcp. The TanStack advisory names no group, and GitHub names no attacker. So the primary sources don't confirm that one group ran every step. They do confirm the pattern: each stolen credential opened the next door.

Why this matters for a business network or website

• Developer laptops hold the keys. One machine with a bad extension exposed cloud, code and password-manager credentials. If an agency or contractor builds your website or app, their laptop holds your keys too.
• Security tools are targets. Trivy is a security scanner. Teams run it with broad access to their build pipelines, and that access is exactly what the attackers wanted.
• A version tag is not a promise. The trivy-action tags were quietly repointed to malicious code. Workflows that pinned a full commit hash were not exposed the same way.
• Auto-update cuts both ways. It delivers fixes fast, and it also delivered a poisoned release within minutes.

If your company runs its own build servers or hosts its own code, see how we approach self-hosting and infrastructure.

What to check this week

If any check comes up positive, Nx and Aqua give the same advice: rotate every credential that was on that machine or reachable from that pipeline, check for the persistence files listed in the Nx advisory (such as ~/.local/share/kitty/cat.py), and think about rebuilding the machine from scratch.

GitHub breach questions people are asking

Was my GitHub account or private repository affected?

GitHub says it has no evidence of impact to customer information stored outside its internal repositories. It says it will notify customers through its incident response channels if it finds any.

What is the Nx Console malware?

It was a poisoned release, 18.95.0, of the Nx Console VS Code extension that stole developer credentials and set up a backdoor. It is tracked as CVE-2026-48027 and fixed in 18.100.0.

Is VS Code safe to use?

The problem was not a flaw in VS Code itself. A third-party extension release was poisoned using a stolen publishing token. The risk is in which extensions you allow and how they update.

Who is TeamPCP?

It is the name tied to the Trivy and LiteLLM compromises and to claims about the GitHub theft. GitHub has not named the attacker.

Do GitHub Enterprise Server admins need to act?

Yes. Rotate the GPG public keys on every instance using GitHub's script, or future upgrades will fail verification. GitHub Enterprise Cloud needs no action.

How do I stop staff installing risky VS Code extensions?

Set an allowlist with extensions.allowed and push it out as the AllowedExtensions policy through your device management.

The bigger lesson

Attackers didn't break into GitHub directly. They worked their way along a chain of trusted tools, a scanner, a Python package, an npm library and an editor extension, collecting keys at each step. Any business that writes or hosts code needs a list of the tools its developers use, an owner for each one, and a plan to rotate keys quickly when one of them goes bad.

We review developer tools, pipelines and servers as part of security hardening; if you want a second set of eyes, request a quote.

Get security alerts like this one by email, with our free checklist, at /security-alerts.

Sources: GitHub: Investigating unauthorized access to GitHub's internal repositories; Nx Console advisory GHSA-c9j4-9m59-847w; Nx postmortem; Aqua Security Trivy advisory GHSA-69fq-xp46-6x23; LiteLLM issue 24518; TanStack advisory GHSA-g7cv-rxg3-hmpx; VS Code: Manage extensions in enterprise environments.