2026-05-28 · 2026-Q2
Nx Console Malicious VS Code Extension Leads to GitHub Repository Breach
Outside the model: Adjacent ecosystemAgent tooling was not the attack surface, so no layer applies.
- Fixable
- Vendor patch
- Vendor response
- Unknown
- In the wild
- Yes
- Actor
- Not applicable
Target
Poisoned Nx Console VS Code extension (malicious build delivered via auto-update) used to compromise a GitHub employee device
Impact
Unauthorized access to and exfiltration of internal GitHub source-code repositories after the trojanized IDE extension ran on the victim's machine
Root cause
A prior Nx developer-system compromise let attackers push a trojanized extension build through the marketplace auto-update channel, abusing the trust developers place in recommended IDE extensions
Sources
Catalog
Cite this: AgentProv incident record: Nx Console Malicious VS Code Extension Leads to GitHub Repository Breach (2026-05-28). https://agentprov.com/incidents/2026-05-28-nx-console-malicious-vs-code-extension-leads-to-github-repository-breach