GitHub's Turn: 3,800 Internal Repositories Accessed

GitHub disclosed unauthorized access to its internal repositories after an employee device was compromised through a poisoned VS Code extension, calling the attacker’s claim of roughly 3,800 repos “directionally consistent” with its own findings. That extension was Nx Console 18.95.0 (as reported), itself compromised via the TanStack attack. The malicious build (CVE-2026-48027) harvested credentials from npm, AWS, GitHub, and 1Password, and was live on the VS Marketplace for only 18 minutes. Aikido points out why 18 minutes were plenty: auto-update gives whoever controls a release a direct push channel into every machine running an extension with 2.2 million installs, and the marketplace adds no waiting period. GitHub reports no evidence of impact to customer data outside its internal repos (some of which do hold support-ticket excerpts), rotated critical secrets, and now requires Enterprise Server customers to update GPG signing keys before installing future patches. The whole chain (npm worm to poisoned IDE extension to GitHub’s own internals) is the supply-chain-risk diagram every conference talk has been drawing for years, except this time it shipped.