GitHub Internal Repositories Breached Via Weaponized VS Code Extension

On May 18, 2026 GitHub confirmed a significant security breach after a weaponized Visual Studio Code extension (a malicious version of Nx Console) compromised an employee endpoint and resulted in exfiltration of roughly 3,800 internal repositories; GitHub removed the extension, isolated the endpoint, rotated critical secrets, and is investigating potential limited exposure of customer-derived data in some internal repositories while reporting no evidence of impact to customer-facing infrastructure.