GitHub breached via a malicious VS Code extension: why developer devices are the real target

A malicious update to the widely used Nx Console VS Code extension (2.2M installs) was briefly backdoored to silently collect credentials and environment files; GitHub confirmed the breach stemmed from this extension and TeamPCP claims data extraction from ~4,000 private repositories. The report highlights how trusted tooling and marketplaces are being weaponized, how traditional EDR can miss interpreted-text payloads, and advocates on-device protections (blocking flagged packages and enforcing a minimum age policy) to reduce exposure.