GitHub confirms breach of 3,800 repos via malicious VSCode extension

Added: 2026-05-25

[00:00:00]Oh, look, another day, another breach.

[00:00:03]GitHub just confirmed that nearly 4,000 repositories got compromised through a malicious VS Code [music] extension.

[00:00:08]You know, that little text editor you trusted because everyone on Twitter said it was fine.

[00:00:12]Here's the beautiful irony.

[00:00:14]Developers spend all day lecturing us about security best practices [music] while casually installing random extensions from the marketplace like they're browsing a sketchy app store in 2009.

[00:00:22]And apparently, one of those extensions decided to help [music] itself to some valuable source code and credentials.

[00:00:27]The extension, naturally, looked legitimate enough to fool thousands [music] of people.

[00:00:31]It probably had a nice description, some stars, maybe even a couple of fake reviews.

[00:00:36]The attacker basically walked in through the front door while everyone was too busy optimizing their Vim configuration to notice.

[00:00:41]>> [music] >> What makes this particularly delicious is that this is the open source community we're talking about.

[00:00:46]The people who invented supply chain security in [music] response to previous disasters.

[00:00:50]And yet here we are again, watching the exact same movie with slightly different [music] actors.

[00:00:54]GitHub has since removed the extension and they're doing the whole responsible disclosure dance, but the damage is already done.

[00:01:00]Your private [music] keys, your API tokens, your unpublished code, it's all probably sitting in some attacker's database right now, and there's not much you can do about it except change literally everything.

[00:01:09]The lesson [music] here, if you even need one, is that trust is a currency we spend too freely in tech.

[00:01:13]We see a few downloads and [music] some decent marketing, and suddenly we're running arbitrary code on our machines without a second thought.

[00:01:19]Link in bio for the full overfitted breakdown.