Build1 publisher3 min readPublished
GitHub lost 3,800 internal repos to code running with its editor's permissions
A dev.to writeup traces roughly 3,800 exfiltrated GitHub repositories to one trojanised Nx Console install from the official Marketplace, where the sandbox that would have contained it has been an open feature request since 2018.
The Engineer · Build desk
What happened
- A dev.to writeup reports that GitHub confirmed roughly 3,800 of its internal repositories were exfiltrated after an employee installed a trojanised version of the Nx Console extension for VSCode.
- The extension arrived through the official VS Code Marketplace, ran with the editor's permissions, and sent back the contents of the employee's repository cache.
- GitHub has linked the campaign to the TanStack npm supply chain attack from earlier this month and pulled the poisoned extension from the marketplace.
- The Marketplace has no sandbox model, and the feature request asking Microsoft to ship one has been open since 2018 without being closed.
- Counting only the campaigns that became public, the post tallies more than 11 million installs of extension code that should not have been on the marketplace.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- exposure Everything the editor process can read is in scope for every extension loaded into it, so one install puts the AWS credentials file and the SSH agent on the same footing as the source tree.
- constraint The only defence the post credits as available today pushes source review of every plugin onto each individual developer.
- decision Standardising the team on Cursor, Windsurf or a JetBrains IDE does not change what an installed extension can read.
- precedent Enforcement in every case the post describes is removal after discovery, so the next campaign gets to bank its install count before anyone takes it down.
Click install and Node.js code starts running inside the editor's process with the editor's permissions, according to the dev.to account of the breach [7]. There is no separate grant to approve. The post sets out the reach: every file in every workspace you have ever opened, every token in `~/.aws/credentials`, every entry in the SSH agent, every byte that ever passed through `git push` [8].
Compare the config line in a Chromium MV3 extension. Host access is declared in `manifest.json` and the browser enforces the declaration, so an extension whose manifest says `"host_permissions": ["https://gmail.com/*"]` cannot reach `bank.example.com` [22]. Capabilities such as `debugger`, `storage` and `nativeMessaging` are declared the same way, and the Chrome Web Store looks at the manifest before publish [23].
The post's author, who works on a browser extension, calls that surface meaningfully better than the editor-extension surface for the same class of attack, and says it is not safe [24][25]. On the editor side the author wrote: "The marketplace is the install surface and the marketplace cannot, in its current shape, distinguish the real extension from the malicious one with the same name." [18]
The install totals are worth checking before anyone quotes them. The post itemises 9 million installs across extensions disguised as legitimate tools twelve months ago [12] and 1.5 million for a pair of AI coding assistants that sent developer data to servers in China in January [14]. Those two add to 10.5 million against a stated total of more than 11 million [15][16]; the cryptominer batch and the 24-extension WhiteCobra set, one of which had basic ransomware capability, are listed without counts [13]. A marketplace-wide install count is a number about someone else's machines, and nine million installs does not say how many of them sat next to production credentials.
TeamPCP is asking $50,000 for the dump, and the post says that as far as anyone outside GitHub can tell, no customer data has moved [4][6]. Spread across roughly 3,800 repositories, that asking price is about $13 each [17].
Three fixes are on the table in the post, and by the author's reading only the third is available now: install nothing you have not read or whose source you cannot audit [21]. A sandbox would mean extensions declaring the file paths, network endpoints and OS capabilities they need into a manifest the user reviews, the way browser permissions are reviewed [19]. A forgeable-proof marketplace would mean reproducible builds, source mirroring and signed releases, and nothing on the marketplace provides that end to end, the post says [20].
The account covers the permission model, the marketplace and those three options. It does not cover what a managed fleet can block [26]. It does say the architecture is inherited: Cursor has it, Windsurf has it, and JetBrains plugins run with the IDE's permissions, just packaged differently [11].
What to watch
- Whether Microsoft closes the 2018 sandbox request by shipping a manifest-permission model for VS Code extensions.