How One Poisoned Plugin Brought Down the World's Largest Code Platform

An 83-day criminal campaign, 3,800 stolen repositories, and live dark web intelligence

GitHub — the world's largest code platform, owned by Microsoft — confirmed that hackers had stolen approximately 3,800 of its own internal repositories. The code behind Copilot, CodeQL, Codespaces, and GitHub Actions was in criminal hands.

The entry point was an 18-minute window in a VS Code plugin installed by a single GitHub employee. No zero-day exploit. No sophisticated attack on GitHub's servers. Just a developer who opened their editor during the wrong 18 minutes.

This report covers the full story: the 83-day campaign that led here, every confirmed victim, live dark web intelligence from TechOwl SHIELD's threat monitoring, and what it means for anyone who writes software.

3,800

Internal GitHub repos stolen

Days the campaign ran

18 min

Malicious plugin was live

500+

Open source packages poisoned

5,561

Additional repos hit in Megalodon

$95K

Asking price for stolen code

The Plugin That Started It All

The weapon was Nx Console (nrwl.angular-console) — a legitimate, popular VS Code extension with 2.2 million installs used by developers building web applications. On May 18, 2026, criminals uploaded a poisoned version (v18.95.0) to the official VS Code Marketplace. It was live for 18 minutes.

Detail	Value
Malicious version	18.95.0
Last clean version	18.94.0
Safe version	18.100.0+
Live on VS Code Marketplace	18 min (12:30–12:48 UTC, May 18)
Live on Open VSX	36 min (12:33–13:09 UTC, May 18)
Total installs (extension)	~2.2 million
CVE	CVE-2026-48027 / GHSA-c9j4-9m59-847w

The moment a developer opened any project in VS Code with the poisoned extension installed, it silently launched a background task disguised as install-mcp-extension and began collecting every valuable credential on the machine: GitHub tokens, AWS keys, Kubernetes secrets, SSH keys, 1Password vault contents, npm tokens, and the configuration files of AI coding assistants like Claude Code. It read credentials directly from running process memory — including masked secrets in GitHub Actions runners — and exfiltrated everything via three independent channels (HTTPS, the GitHub API, and DNS tunneling), all encrypted with AES-256-GCM.

Why 18 minutes was enough: VS Code automatically updates installed extensions in the background without any prompt. Any developer who had Nx Console installed and opened VS Code during that 18-minute window silently received the malicious version — without clicking anything or doing anything wrong.

How It Happened — Step by Step

May 11, 2026

An Nx developer installs a booby-trapped package. During a routine pnpm install, a malicious @tanstack/zod-adapter package executes — a supply chain protection setting was silently ignored by an outdated tool version. The malware steals the developer's GitHub CLI OAuth token from ~/.config/gh/hosts.yml.

7 days of silence

May 11–17, 2026

Seven days of silence — and log deletion. TeamPCP sits quietly inside the contributor's GitHub account, methodically deleting GitHub Actions workflow run logs to cover their tracks. No alarms triggered.

attack window opens

May 18, 12:30 UTC

Poisoned Nx Console v18.95.0 goes live. Using stolen VS Code Marketplace credentials, TeamPCP uploads the malicious version. VS Code begins silently pushing auto-updates to 2.2 million machines.

6 minutes

May 18, 12:36 UTC

Nx maintainer gets a routine email. The VS Code Marketplace sends a standard upload notification. A maintainer recognises the anomaly and triggers an emergency response.

11 minutes

May 18, 12:47 UTC

Extension removed — but too late. ~6,000 machines already activated the malicious version, including a GitHub employee's workstation. Credentials harvested and exfiltrated.

overnight

May 18–19

GitHub's internal systems looted. Harvested credentials used to clone ~3,800 internal repos: Copilot, CodeQL, Actions, Codespaces, Dependabot, OAuth proxy, GitHub Models, MCP servers, internal security tooling, and a Rails Pull Requests Controller managing organisational access.

80 minutes before GitHub speaks

May 20, 3:40 AM UTC

TeamPCP taunts GitHub on X. @xploitrsturtle2: "Github knew for hours, they delayed telling you and they wont be honest in the future. what an amazing run, its been an honor to play around with the cats over the past few months."

May 20, 5:04 AM UTC

GitHub confirms the breach. ~3,800 repos confirmed, customer data unaffected, critical secrets rotated. Full incident report promised — as of this writing, still unpublished.

The 83-Day Campaign Behind It

The GitHub breach was not an isolated incident. It was the finale of an 83-day campaign built on a credential cascade: steal tokens from one organisation, use them to break into the next. Each victim unlocked the door to the next one.

Date	Target	Impact
Feb 27	Trivy (Aqua Security)	Publisher tokens stolen in 44 min; EU Commission AWS key captured
Mar 21	Checkmarx KICS	35 GitHub Action tags compromised
Mar 24	LiteLLM (AI gateway)	Versions 1.82.7–1.82.8 backdoored; Mercor AI hit downstream
Mar 27	Telnyx SDK	WAV steganography technique introduced
Apr 22	Bitwarden CLI	Password manager backdoored 1.5 hrs; AI assistant targeting introduced
May 11	TanStack (42 packages)	84 malicious versions in 6 min; 2 OpenAI devices; Nx contributor creds stolen
May 14–15	Mistral AI, UiPath, OpenSearch	$25K extortion of Mistral; 450 repos stolen
May 18–20	GitHub, Grafana, Cisco	3,800 internal repos; simultaneous Megalodon attack on 5,561 public repos

The chain in one line: Trivy → Checkmarx → LiteLLM → Telnyx → TanStack → Nx contributor's machine → GitHub publishing token → poisoned VS Code plugin → GitHub employee's machine → 3,800 repos.

Every Known Victim

GitHub

Crown Jewel

~3,800 internal repos — Copilot, CodeQL, Codespaces, Actions, Dependabot, OAuth proxy, GitHub Models, MCP servers. Listed for sale at $95,000. No customer repos affected.

European Commission

Government

92 GB compressed / 340 GB uncompressed from EU AWS account. Personal data from 71 EU entities. ShinyHunters published the full dump. GDPR notifications triggered.

Cisco

Enterprise

300+ internal repos including unreleased AI products. ~3M Salesforce records (FBI, IRS, NASA, DHS, Australian Ministry of Defence data included). AWS infrastructure keys.

Grafana Labs

Tech

Codebase downloaded, not altered. One missed GitHub workflow token. Ransom demand received May 16 — declined to pay. Also separately targeted by Coinbase Cartel ransomware.

OpenAI

macOS code-signing certs stolen (Axios, Mar 31). Two employee devices compromised again via TanStack (May 11). Named by GitHub CISO Alexis Wales.

Mistral AI

450 repos / ~5 GB of training & inference code. $25,000 extortion, 1-week pay-or-leak deadline. Mistral confirmed breach, disputed scope.

Mercor ($10B AI Startup)

40,000+ contractor records, video interviews, AI training methodologies for OpenAI, Anthropic & Meta. LAPSUS$ claims 4 TB total. Meta suspended all work. Class action filed.

Bitwarden + TanStack + SAP

Intermediate

Each compromised and used as stepping stones in the credential cascade. Bitwarden CLI backdoored for 1.5 hrs. TanStack: 84 malicious versions. SAP: ~570K weekly download packages.

Who Is TeamPCP?

TeamPCP is a financially motivated cybercriminal group that first appeared in late 2025, tracked by Google as UNC6780. They are not elite nation-state hackers. Their code is largely copy-paste with AI-assisted modifications. What makes them dangerous is scale and automation — turning known weaknesses into a production-line attack operation.

Aliases	PCPcat · ShellForce · PersyPCP · DeadCatx3 · CipherForce
Telegram	@team_pcp · @Persy_PCP · ~700 members
Partners	LAPSUS$ (data sales) · VECT Ransomware Group (profit-split)
Likely base	Africa (Kenya indicators in Telegram; Kenyan govt accused them of hacking state systems)
Revenue	Source code sales · Extortion · Cryptomining (60,000+ compromised servers) · Access brokerage

"TeamPCP's distinguishing feature is not innovation, but scale — industrializing old, well-understood attack methods."

On May 13–14, TeamPCP published the full worm source code on GitHub under an MIT license — "Shai-Hulud: Open Sourcing The Carnage" — and announced a $1,000 Monero competition on BreachForums for whoever caused the most damage using it. Security researchers documented four copycat campaigns within five days. Attribution is now permanently muddied — which was the point.

Dark Web Intelligence

The following intelligence was retrieved through TechOwl SHIELD's dark web monitoring, covering Telegram channels, TOR forums, and dark web leak sites. Three GitHub-specific entries were confirmed from the breach period.

TELEGRAMLZT — Russian Cybersecurity News Channel · May 20, 2026

GitHub Breach Announced Before GitHub's Own Statement

"Hackers allegedly compromised GitHub by distributing a malicious VS Code extension that was downloaded by an employee. The attack reportedly resulted in unauthorized access to an internal database, exfiltration of approximately 3,800 repositories, and theft of access credentials and API keys."

LZT Telegram channel reporting the GitHub breach — posted before GitHub's own statement. Source: TechOwl SHIELD Threat Intelligence

Posted 80 minutes before GitHub's own public statement
Independently confirmed the VS Code extension vector and 3,800 repository figure

TELEGRAM · CVE-2026-3854Cyberban News — Persian Security Channel · Apr 29–30, 2026

GitHub RCE Circulating on Telegram 18 Days Before the Breach

"A critical vulnerability in GitHub (CVE-2026-3854) was disclosed allowing authenticated users to execute arbitrary code on GitHub backend servers via a single git push command. GitHub has patched the vulnerability with no confirmed exploitation detected. However, 88% of GitHub Enterprise Server instances remain unpatched and vulnerable to full server compromise."

Cyberban News reporting CVE-2026-3854 on Telegram — 18 days before the GitHub breach. Source: TechOwl SHIELD Threat Intelligence

CVSS 8.7 — RCE via unsanitized X-Stat header injection in GitHub's babeld. Single git push achieves arbitrary code execution.
GitHub.com patched within 2 hours (Mar 4). Enterprise Server 88% unpatched at public disclosure Apr 28.
No confirmed link to TeamPCP — but it was circulating in the same Telegram channels they monitored.

TELEGRAMCyberban News — Persian Security Channel · May 20, 2026

Grafana Breach Confirmed on Telegram — Same Day as GitHub

"Grafana confirmed a cyberattack where threat actors gained unauthorized access to portions of the company's GitHub repositories using a stolen security token. Attackers exfiltrated internal files and source code. After initial access was revoked, attackers extorted Grafana with a ransom demand."

Grafana breach confirmed on Telegram the same day as GitHub's disclosure. Source: TechOwl SHIELD Threat Intelligence

Caused by a single missed GitHub workflow token — Grafana rotated most tokens after TanStack but overlooked one
Ransom demand received May 16; Grafana declined to pay (aligned with FBI guidance)
Codebase downloaded, not altered — no customer impact confirmed
Both the GitHub and Grafana breaches confirmed in criminal Telegram channels simultaneously

Infostealer Intelligence — github.okta.com

TechOwl SHIELD's dark web monitoring captured 4 compromised credentials hitting GitHub's Okta SSO portal during the breach window:

Date	Username	Significance
2026-05-24	[email protected]	GitHub employee Okta SSO — 4 days post-breach disclosure. Machine unremediated or re-infected.
2026-05-24	[email protected]	External account hitting GitHub's internal SSO — anomalous
2026-03-07	(blank)	Anonymous hit during early Trivy/Checkmarx wave
2026-03-07	(blank)	Second anonymous hit same day

IOC Reference

Quick check — run this if you have Nx Console installed:

# Check for malicious Nx Console version

code --list-extensions --show-versions | grep angular-console

# [email protected] = compromised → update to 18.100.0+

# Check for persistence artifacts

ls ~/.local/share/kitty/cat.py

ls ~/Library/LaunchAgents/com.user.kitty-monitor.plist

ls /var/tmp/.gh_update_state

Malicious file hashes

# Nx Console v18.95.0 VSIX

1a4afce34918bdc74ae3f31edaffffaa0ee074d83618f53edfd88137927340b8

# cat.py macOS backdoor

fb5c97557230a27460fdab01fafcfabeaa49590bafd5b6ef30501aa9e0a51142

C2 domains to block

audit.checkmarx[.]cx

check.git-service[.]com

scan.aquasecurtiy[.]org

*.lhr.life

Dead-drop C2 GitHub search keywords

# Nx Console / cat.py backdoor

firedalazer

# durabletask PyPI worm

FIRESCALE

# Bitwarden CLI variant

LongLiveTheResistanceAgainstMachines

What To Do Right Now

If you're a developer:

Update Nx Console to 18.100.0+ immediately

If you see [email protected] — treat the machine as compromised and rotate all credentials.

Disable VS Code automatic task execution

Set task.allowAutomaticTasks: "off" in VS Code global settings. Use an extension allowlist if your org supports it.

Block the IOC domains at DNS/egress

Add the C2 domains above to your DNS blocklist. Monitor for outbound connections from IDE processes (Code.exe, code) to non-vendor domains.

If you run a software team:

Require 2 approvers on all package publishing pipelines

A single stolen token is no longer enough to ship to production if a second human must approve from their own device.

Audit all GitHub Actions workflows for pull_request_target

The TanStack attack used this documented-but-dangerous trigger. Every workflow using it is a potential cache poisoning entry point.

Run npm ci --ignore-scripts in all CI pipelines

Defeats the entire class of postinstall-hook payload delivery used by the Shai-Hulud worm family.

The Bottom Line

This attack exploited no software vulnerability. There was no unpatched server, no phishing email, no brute-forced password. A developer installed a legitimate, popular, officially-distributed VS Code plugin — and that was enough to hand attackers 3,800 of GitHub's most sensitive repositories.

Developer machines have been trusted by default for decades. They hold the keys to CI/CD pipelines, cloud infrastructure, and production secrets. TeamPCP spent 83 days proving that assumption is catastrophically wrong.

Treat your developer workstation as a primary attack surface — not a trusted inside node. The credential cascade that led here started with a single misconfigured pnpm install on May 11. GitHub was the last door in a very long chain.

Official References

TechOwl SHIELD

Continuous Threat Intelligence & Attack Surface Monitoring

Vulnerability Assessment

Deep technical analysis of vulnerabilities affecting your infrastructure — beyond CVSS scores to real-world exploitability and impact.

Attack Surface Intelligence

Passive mapping of your external presence — every exposed service, endpoint, and piece of infrastructure visible to the public internet.

Threat Hunting

Proactive detection of compromise indicators, APT activity, and post-exploitation artifacts across your email and identity infrastructure.

Dark Web Monitoring

Continuous surveillance of stolen credential markets, threat actor forums, and data leak channels. Know when you're being targeted before it becomes an incident.

techowlshield.com