GitHub and Grafana Labs Breaches Linked to Malicious Nx Console VS Code Extension in TanStack Supply Chain
What Happened — A malicious version of the popular Nx Console VS Code extension was published to the Visual Studio Marketplace and the Open VSX registry. The compromised extension harvested GitHub, HashiCorp Vault, Kubernetes, AWS, GCP, Docker, and 1Password credentials, which attackers used to access CI/CD pipelines and exfiltrate roughly 3,800 private GitHub repositories belonging to GitHub and Grafana Labs.
Why It Matters for TPRM —
- Supply‑chain compromise of a developer‑tool ecosystem can give threat actors unfettered access to downstream customers’ code and secrets.
- Credential theft across multiple cloud and secret‑management platforms amplifies lateral movement risk for any organization that integrates those services.
- The incident demonstrates that low‑download extensions can still affect thousands of developers, expanding the attack surface beyond “high‑profile” software.
Who Is Affected — SaaS development platforms, cloud‑native tooling vendors, and any organization that installs VS Code extensions from public registries (tech‑SaaS, cloud‑infra, DevOps tooling).
Recommended Actions —
- Conduct an immediate inventory of all VS Code extensions in use and remove any from untrusted sources.
- Rotate every credential that could have been exposed (GitHub tokens, cloud keys, Vault tokens, 1Password entries).
- Enforce strict extension signing verification and limit CI/CD token scopes.
- Review third‑party risk policies for open‑source component provenance and supply‑chain monitoring.
Technical Notes — Attack vector: compromised third‑party dependency (malicious Nx Console extension). No public CVE; the payload fetched over HTTPS/DNS and attempted sudoers injection on Linux. Exfiltrated data included personal access tokens, OAuth/app tokens, cloud provider keys, Docker credentials, and secrets stored in HashiCorp Vault and 1Password. Source: Help Net Security