Malicious Nx Console VS Code Extension Stole GitHub Tokens
A malicious version of the Nx Console VS Code extension, installed by thousands, stole GitHub tokens and sensitive data before being removed from the marketplace.
A malicious version of the popular Nx Console extension for Visual Studio Code was available on the official VS Code Marketplace for approximately 18 minutes, during which time it managed to steal GitHub tokens and sensitive data from developers who installed it. This incident represents one of the most significant breaches involving developer tools in 2026, given the extension's widespread adoption with over 2.2 million installs across its various versions.
The threat group TeamPCP, previously linked to compromising Aqua Security's Trivy scanner, is believed to be behind this attack. They reportedly used stolen publishing credentials to inject the backdoor into the Nx Console extension. According to GitHub's investigation, which was described as "directionally consistent" by the company, the attackers claimed to have exfiltrated around 3,800 internal repositories from a single GitHub employee's device. However, GitHub stated there was no evidence of customer-owned repositories being affected.
Analysts at BlackFog detailed the campaign in a report, highlighting how TeamPCP has systematically exploited developer tools for data theft. The Nx Console incident is not an isolated event but rather a continuation of a broader campaign that began months earlier, targeting build systems and security tools. TeamPCP, which emerged in late 2025, is primarily motivated by financial gain. Its Telegram channel, launched in November 2025, quickly grew, and by March 2026, the group had infiltrated Aqua Security's build systems, embedding credential-stealing code within the Trivy vulnerability scanner.
Following the Trivy compromise, TeamPCP leveraged the stolen credentials to target other tools, including Checkmarx KICS and LiteLLM. The LiteLLM package was notably compromised with a backdoor in two of its versions. The campaign then shifted focus on May 18, 2026, moving from build pipelines to individual developers by introducing the compromised Nx Console extension to the marketplace. This malicious version executed directly on developers' machines, granting it access to any data the developer could reach, including source code, cloud keys, and GitHub tokens.
BlackFog's research indicates a consistent pattern in TeamPCP's operations: infiltrate existing software, harvest secrets, exfiltrate data, and then utilize it. In the Trivy incident, the malware scanned process memory on GitHub-hosted runners for secrets and checked over 50 common paths for sensitive files on self-hosted runners. The stolen data was encrypted using AES-256-CBC and an RSA-4096 public key, bundled into a tpcp.tar.gz archive, and transmitted over HTTPS to a domain mimicking Aqua's legitimate one. As a fallback, if the upload failed and a sufficiently strong personal access token was available, the payload could create a repository named 'tpcp-docs' in the victim's GitHub account and attach the archive to a release, masking the exfiltration as legitimate activity from the victim's account.
The brief 18-minute availability of the malicious extension belies the long-term damage it could inflict. Removing the compromised package does not revoke the access it already gained. BlackFog reported that some stolen tokens were used weeks after the initial compromise, and credentials stolen in March were observed being used to probe other victim environments later. Furthermore, stolen GitHub repositories were reportedly offered for sale for at least $50,000.
TeamPCP monetizes its activities through various means, including selling leaked data via ShellForce, offering credentials and source code for sale, and collaborating with ransomware groups like Vect. Hijacked servers have also been repurposed for cryptomining and proxy services. The broader implications of such attacks are evident in related incidents, such as the Mini Shai-Hulud npm campaign, which prompted npm to reset publishing tokens that bypassed two-factor authentication.
Law enforcement has begun to respond to these threats. In August 2026, Australian authorities charged two individuals alleged to be key members of TeamPCP, with the U.S. Department of Justice also issuing an indictment against one of them. While these allegations are unproven, a recent FBI warning specifically addressing TeamPCP underscores the seriousness with which officials view the threat to developer tools. For mitigation, BlackFog recommends rigorous review of third-party actions, pinning commit SHAs in workflows, implementing least-privilege access for CI/CD jobs with short-lived credentials, and considering delayed updates for extensions and packages on developer machines. Teams should also limit public access to sensitive services like Docker APIs, Kubernetes control planes, and Redis servers, and patch applications against known vulnerabilities like React2Shell (CVE-2025-55182). Monitoring outbound traffic for signs of data exfiltration remains a critical defense strategy.