#0001
GitHub confirms 3,800 repositories compromised via malicious `VS Code` extension
60radar
A single developer workstation became the entry point. VS Code extension trust is now part of supply-chain security, so extension audits are worth doing now.
- About 3,800 internal repositories were affected after one employee installed a trojanized
VS Codeextension. - GitHub’s current assessment limits exposure to internal repositories, but compromised developer endpoints can still leak secrets and code context.
- The extension was removed from
VS Code Marketplace, infected endpoints were isolated, and incident response started immediately. - Practical takeaway: review installed IDE extensions, publisher names, permissions, and disable unused tools before they become build-chain risk.
Source: news.hada.io/topic?id=29731Read original →