Unit 42 Threat Intelligence • 4w
GitHub Internal Repository Breach via Poisoned Nx VS Code Extension
A high-impact supply chain attack has compromised approximately 3,800 of GitHub's internal repositories. The breach originated from a poisoned version of the 'nrwl.angular-console' (Nx Console) Microsoft Visual Studio Code extension. By infiltrating a GitHub employee's development environment, the threat actor likely leveraged token-stealing mechanisms or a VS Code zero-day vulnerability to exfiltrate authentication tokens and access proprietary source code. The compromised data, including sensitive internal intellectual property, has reportedly been listed for sale on underground dark web forums. This incident highlights critical risks in developer tooling and the potential for secondary compromises through stolen credentials.
Links:Unit 42 Threat Intelligence, GitHub Security Blog, feeds.feedburner.com, wiz.io, Huntress, Stepsecurity, Helpnetsecurity, Cybersecuritydive, News, Sophos News, Malwarebytes, CISA Cybersecurity Advisories, microsoft.com, Nx, Armorcode, Paloaltonetworks, Blog, Xda-developers, Varonis, About, Safestate, Phoenix, Riskprofiler, Bankinfosecurity, Grip, Reddit, Forbes, Hhs, gbhackers.com, The Record by Recorded Future, Hackread, Cyderes, App, Infoworld, Thenextweb, techjacksolutions.com, Cybersecuritynews, Mallory, Scworld, Socprime, Infosecurity-magazine, Ebuildersecurity, Breachsense, Aiweekly, Cyberpress, Techrepublic, Gigazine, Kravensecurity, Cypro, Technadu, Labs, Kucoin, Neuracybintel, Ironcastle, Isc, Endorlabs, Arcticwolf, Oasis, Fieldeffect, Socradar, Ampcuscyber, Ransomware, Hookphish, Blackpointcyber, Pdctech, Thehackernews, Lokker, Squaredtech, Radar, Zvelo, Sonatype, Redsift, Vicarius, bleepingcomputer.com, SC Media, cyberinsider.com, Github, Almeidalawgroup, Claimdepot, Classactionu, Linuxsecurity, Aikido, SecurityWeek •