GitHub Breached: Supply Chain Attack on Nx Console Compromises Internal Repos

LΣҒΔ𝕽ΩLL 🇮🇱 reports that GitHub recently experienced a significant breach, confirming an employee was compromised via a malicious version of Nx Console for VS Code. This tainted version was published to the VS Code Marketplace following a supply chain attack targeting Nx. The incident highlights the acute risks of developer tooling and the software supply chain.

The attack window was remarkably brief—approximately 18 minutes. Yet, in that short span, attackers successfully deployed a stealer to developer machines, including those in sensitive environments. GitHub confirmed the theft of around 3,800 internal repositories. LΣҒΔ𝕽ΩLL 🇮🇱 notes that while these were not customer repositories, they did contain GitHub’s internal code, with some potentially including segments from customer support interactions.

This incident underscores how quickly a focused adversary can leverage a supply chain compromise to achieve deep access. Even a short window is more than enough for initial access and data exfiltration when targeting developers with privileged access to internal systems and codebases. The attacker’s calculus here was precise: hit the developer tools, and the rest follows.