Employee device compromised through malicious Nx Console extension led to access of internal GitHub repositories.
- GitHub confirms breach of internal repositories through compromised employee device
- Attack vector was a poisoned version of the Nx Console VS Code extension
- Nx team reports their extension was compromised after developer system was hacked
GitHub has confirmed that a breach of its internal repositories resulted from the compromise of an employee device using a malicious version of the Nx Console extension for Microsoft Visual Studio Code.
The attack targeted the nrwl.angular-console extension, according to The Hacker News. The Nx team disclosed that their extension was compromised after one of their developers’ systems was hacked.
GitHub made the official confirmation on Wednesday, detailing how the supply chain attack progressed from the initial compromise of the VS Code extension to accessing internal company repositories.
The incident represents a sophisticated supply chain attack where threat actors first compromised a developer at Nx, then used that access to poison the widely-used VS Code extension. When GitHub employees installed or updated the extension, the malicious code provided attackers with a foothold into GitHub’s internal systems.
VS Code extensions have become an increasingly popular attack vector due to their widespread adoption in development environments and the level of system access they typically require to function effectively.
The breach highlights the challenge organisations face in securing their development environments against supply chain attacks targeting developer tools and extensions. Such attacks can provide direct access to source code repositories and development infrastructure.
Why It Matters
This incident demonstrates how supply chain attacks targeting developer tools can bypass traditional perimeter security measures. For CISOs, it underscores the need to treat developer environments as critical infrastructure requiring specific security controls and monitoring.
The attack vector through a VS Code extension represents a growing threat category that traditional security tools may not adequately address, potentially requiring new approaches to secure development environments and third-party integrations.
What To Do Now
- Review and audit all VS Code extensions and developer tools in use across the organisation
- Implement controls for approving and managing third-party development extensions
- Consider implementing additional monitoring for developer environment activities and repository access
