GitHub Breach via Malicious Nx Console VS Code Extension: Detection & Hardening

---
title: Potential Malicious VS Code Extension Spawning Shell
id: 8a4b1c92-5d6e-4f3a-9b1c-2d3e4f5a6b7c
status: experimental
description: Detects Visual Studio Code or its Extension Host spawning a command shell, which is unusual behavior for an extension and may indicate code execution.
references:
  - https://thehackernews.com/2026/05/github-internal-repositories-breached.html
author: Security Arsenal
date: 2026/05/06
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|contains:
      - '\Code.exe'
      - '\extension-host.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  filter_legit_terminal:
    # Filter VS Code Integrated Terminal usage where parent is the main Code.exe and user is interactive
    # Note: In a strict environment, extension shell usage is rare. Adjust based on usage.
    CommandLine|contains: 'Microsoft VS Code'
  condition: selection and not filter_legit_terminal
falsepositives:
  - Developers using the Integrated Terminal (Standard behavior, may be noisy)
  - Legitimate debugging workflows requiring shell access
level: medium
---
title: VS Code Extension Accessing Git Credentials
id: 9c5d2e83-6e7f-4a1b-0c2d-3e4f5a6b7c8d
status: experimental
description: Detects VS Code processes reading sensitive Git credential files or SSH keys, potentially indicating credential theft by a malicious extension.
references:
  - https://thehackernews.com/2026/05/github-internal-repositories-breached.html
author: Security Arsenal
date: 2026/05/06
tags:
  - attack.credential_access
  - attack.t1552.001
logsource:
  category: file_access
  product: windows
detection:
  selection:
    Image|contains:
      - '\Code.exe'
      - '\node.exe' # Extensions often run in node
    TargetFilename|contains:
      - '\.git\config'
      - '\.ssh\id_rsa'
      - '\.ssh\id_ed25519'
      - '_netrc'
  condition: selection
falsepositives:
  - Standard Git operations performed by the developer (requires context)
level: high


**KQL (Microsoft Sentinel / Defender)**

// Hunt for suspicious processes spawned by VS Code or Extension Host
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("Code.exe", "extension-host.exe", "node.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "curl.exe", "wget.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, SHA256
| order by Timestamp desc


**Velociraptor VQL**

-- Hunt for the presence of the specific malicious extension ID or suspicious modifications
SELECT 
  FullPath,
  Mtime,
  Size,
  parse_(Data).name AS Name,
  parse_(Data).publisher AS Publisher,
  parse_(Data).version AS Version
FROM glob(globs='/*/.vscode/extensions/*/package.')
WHERE Name =~ "nx-console" OR Publisher =~ "nrwl"
-- Further investigation: Check for unexpected JS files in the extension directory


**Remediation Script (PowerShell)**

# Remediation Script for Nx Console Malicious Extension
# Run with elevated permissions

Write-Host "[+] Starting Audit and Remediation of Nx Console Extension..." -ForegroundColor Cyan

# Define malicious extension identifier (Based on nrwl.angular-console)
$MaliciousPublisher = "nrwl"
$ExtensionName = "nx-console"

# Get all user profiles on the system
$UserProfiles = Get-CimInstance -ClassName Win32_UserProfile | Select-Object -ExpandProperty LocalPath

foreach ($ProfilePath in $UserProfiles) {
    $ExtPath = Join-Path -Path $ProfilePath -ChildPath ".vscode\extensions"
    
    if (Test-Path $ExtPath) {
        Write-Host "[*] Scanning path: $ExtPath" -ForegroundColor Yellow
        
        # Find extensions matching the malicious publisher/name
        $TargetExtensions = Get-ChildItem -Path $ExtPath -Directory | Where-Object { 
            $_.Name -like "$MaliciousPublisher.*" -or $_.Name -like "*$ExtensionName*" 
        }

        if ($TargetExtensions) {
            foreach ($Ext in $TargetExtensions) {
                Write-Host "[!] FOUND SUSPICIOUS EXTENSION: $($Ext.FullName)" -ForegroundColor Red
                
                # Option to force remove the directory
                try {
                    Remove-Item -Path $Ext.FullName -Recurse -Force -ErrorAction Stop
                    Write-Host "[+] Successfully removed: $($Ext.Name)" -ForegroundColor Green
                }
                catch {
                    Write-Host "[-] Failed to remove: $_" -ForegroundColor DarkRed
                }
            }
        } else {
            Write-Host "[+] No malicious extensions found in this profile." -ForegroundColor Green
        }
    }
}

Write-Host "[+] IMPORTANT: If a malicious extension was found, you must immediately rotate GitHub Personal Access Tokens (PATs) and SSH keys used on this host." -ForegroundColor Magenta