GitHub VS Code Hack: One Extension Stole 3,800 Repos in 18 Minutes (2026 Attack)

On May 18, 2026, a single malicious VS Code extension update silently exfiltrated 3,800 of GitHub's internal repositories in under 18 minutes. Here's the full breakdown of the most sophisticated developer supply chain attack of 2026 — and exactly what you need to do if you were affected. The weapon? Nx Console, a trusted VS Code extension with 2.2 million installs and a verified publisher badge. A 2,777-byte backdoor hidden inside version 18.95.0 harvested credentials from 1Password, GitHub, AWS, npm, and Claude configurations. One GitHub employee auto-updated during the exposure window. That was all it took. This attack didn't come out of nowhere. It's the seventh strike in a nine-month campaign by threat actor TeamPCP — the same group behind the TanStack CVE-2026-45321 npm compromise in early May. The stolen GitHub data is currently being auctioned on a cybercrime forum starting at $50,000. If you're a developer who uses VS Code, this video could literally save your job. ⏱️ TIMESTAMPS 0:00 – 3,800 Repos Stolen: The Hook 0:29 – How the Malicious Extension Was Published 0:46 – The Hidden Payload Explained 1:02 – TeamPCP: The Threat Actor Behind the Attack 1:20 – How the Chain Reaction Unfolded 1:36 – The 18-Minute Exposure Window 1:53 – GitHub Confirms the Damage 2:10 – The Dark Web Auction 2:18 – Why Developers Miss This Threat 2:28 – Action Step 1: Check If You Were Exposed 2:38 – Action Step 2: Treat Your Device as Compromised 2:48 – Action Step 3: Disable VS Code Auto-Updates Now 2:54 – The Megalodon Campaign: What's Coming Next 3:04 – CISA Adds Both Flaws to KEV Catalog 3:13 – Final Takeaway and Call to Action 🔔 Subscribe for daily cybersecurity breakdowns — new developer security threats covered every day. 👍 Hit Like if this changed how you think about VS Code extensions. 💬 Comment: How many extensions did you just disable? #VSCode #GitHub #CyberSecurity #SupplyChainAttack #NxConsole #TeamPCP #DevSecurity #Hacked #MaliciousExtension #InfoSec