GitHub confirms breach of 3,800 repos via malicious VSCode extension

Back to Devoured - May 21, 2026

DEVOURED

GitHub confirms breach of 3,800 repos via malicious VSCode extension

GitHub confirmed a security breach affecting 3,800 repositories due to a malicious, unnamed VS Code extension that has since been removed.

What: GitHub confirmed that 3,800 repositories were compromised by an unnamed trojanized VS Code extension. The malicious extension was subsequently removed from the VS Code marketplace.

Why it matters: This incident highlights the growing supply chain risk introduced by third-party extensions in popular developer tools like VS Code, which can serve as vectors for sophisticated attacks targeting developer environments and codebases.

Takeaway: Review the extensions installed in your VS Code environment, especially if you have sensitive repositories on GitHub, and verify their legitimacy and permissions.

Decoder

Trojanized extension: A software extension that appears legitimate but contains hidden malicious code, similar to a Trojan horse.

Original article

GitHub has since removed the unnamed trojanized extension from the VS Code marketplace.

Explore all 58 articles in today's digest