The sketchiest thing in your stack might not be your app.

It might be the tool you installed to build it faster.

That is the uncomfortable lesson from the poisoned VS Code extension story. Not because developers should stop using extensions. Not because every plugin is malware. Not because speed is bad.

Speed is the job.

The problem is that modern dev tools do not just make building easier. Some of them sit right beside the valuable stuff.

Your repo.

Your terminal.

Your .env files.

Your GitHub session.

Your package manager.

Your cloud CLI.

Your SSH keys.

Your AI coding assistant config.

That changes the risk.

A tool you install for speed can become a tool an attacker uses for inherited access.

The extension was not dangerous only because it was malicious. It was dangerous because it was allowed to stand next to everything valuable.

AlphaHunt

Stop doomscrolling, start decisioning. We chewed through the muck so your team doesn’t have to. → Subscribe!

Like this? Forward this to a friend!

(Have feedback? Did something resonate with you? Did something annoy you? Just hit reply! :))

What happened

On May 20, GitHub said it had detected and contained a compromise of an employee device involving a poisoned third-party VS Code extension. GitHub said its current assessment was that GitHub-internal repositories were exfiltrated, and that the attacker’s claim of roughly 3,800 repositories was directionally consistent with its investigation so far.

GitHub also said it had no evidence of impact to customer-owned enterprises, organizations, or repositories outside GitHub’s internal repositories, though some internal repositories may contain customer-related material such as support excerpts.

That distinction matters.

This was not GitHub saying customer repos were breached. It was GitHub saying an employee device was compromised, internal repositories were exfiltrated, critical secrets were rotated, and the investigation was still ongoing.

In the same window, Nx published a postmortem for a malicious Nx Console VS Code extension version, 18.95.0, pushed to the Visual Studio Marketplace and Open VSX on May 18. Nx said the malicious Visual Studio Marketplace version was live for about 11 minutes and the Open VSX version for about 36 minutes.

Nx also told anyone who installed that version to treat the machine as compromised and rotate credentials.

StepSecurity’s analysis described the Nx Console compromise as a multi-stage credential stealer targeting developer and cloud-adjacent material, including GitHub, npm, AWS, HashiCorp Vault, Kubernetes, 1Password, and Claude Code configuration files.

The headline is poisoned extension.

The lesson is bigger:

The developer workbench is now part of the supply chain.