GitHub links repo breach to TanStack npm supply‑chain attack

GitHub discovered that hackers who breached 3,800 internal repositories accessed the platform through a malicious version of the Nx Console VS Code extension, which was compromised in the TanStack npm supply‑chain attack. The poisoned extension, version 18.95.0, was available on the Visual Studio Marketplace for 18 minutes and on OpenVSX for 36 minutes, during which it stole credentials for npm, AWS, Kubernetes, GitHub, and GCP/Docker by injecting a payload into the VS Code environment. Approximately 6,000 activations of the compromised extension were logged, all from VS Code, with no activations from other editors. TeamPCP, the threat group behind the attack, claimed access to about 4,000 private GitHub repositories and demanded $50,000 for the stolen data. GitHub rotated critical secrets on Monday and Tuesday, prioritizing the highest‑impact credentials, and continues to monitor for follow‑on activity. The breach was traced back to the TanStack npm supply‑chain attack that compromised dozens of TanStack and Mistral AI packages, illustrating the risk of third‑party extensions and supply‑chain dependencies.

The incident underscores the importance of monitoring extension usage, rotating secrets, and enforcing strict access controls on CI/CD pipelines to prevent credential theft and unauthorized repository access.