The Wild West of VS Code extensions and how a poisoned extension breached GitHub

What it is

Analysis of the malicious Nx Console v18.95.0 push (Visual Studio Marketplace and OpenVSX) and, more usefully, the concrete exposure windows, the payload structure, and the rotation guidance a defender needs. The build was uploaded to the VS Marketplace at 12:30 UTC on May 18 and unpublished at 12:47 (Microsoft registered takedown 12:48) — ~18 minutes. The same build was live on OpenVSX from 12:33 to 13:09 UTC — ~36 minutes, twice as long as earlier reporting claimed.

How it works

The payload was a 2,777-byte injection into a minified file inside the extension, which then fetched a ~498 KB obfuscated dropper from an orphan commit in the official nrwl/nx repository. Because extensions ship as interpreted JavaScript, EDR has no signature for a minified diff against an already-trusted extension.

The key correction to a "12-hour timer" mental model: auto-update fires mainly through a gallery-sync side effect, not the fallback timer. Any marketplace interaction (Extensions sidebar visible, search, recommendation lookup, background metadata fetches) syncs installed extensions against the gallery and fires eventuallyAutoUpdateExtensions (throttled to 1s) with no prompt. Aikido's own testing saw auto-update fire within minutes of publish. This is why an 18-minute window on a 2.2M-install extension caught far more machines than a periodic timer would.

Preconditions / Affected

Nx Console installed with extensions.autoUpdate on (the default) and any gallery interaction touching the listing during the exposure windows above. The publish itself required only a contributor's GitHub token, scraped in an earlier supply-chain attack — the pipeline accepted the stolen token at face value.

What to do

Per the maintainers' advisory: anyone who had Nx Console installed with auto-update enabled during those windows should assume compromise and rotate anything credentials-adjacent on disk — tokens, secrets, SSH keys. There is no marketplace review gate or waiting period between publish and client pull, so disabling default auto-update is the structural mitigation the piece points to. Detection is hard: the malicious diff is minified JS, invisible to signature-based EDR.

Caveats

Earlier reporting stated OpenVSX was unaffected; the updated advisory contradicts this (12:33–13:09 UTC). The "within minutes" auto-update timing is Aikido's own testing observation of the gallery-sync path, not a fixed guaranteed interval — the documented fallback timer is 12 hours (1 hour on Insiders).

Prior pattern

This is not new: AsyncAPI's November 2025 compromise (Shai-Hulud 2.0 first-blood) used stolen npm and OpenVSX tokens that had sat in GitHub repository secrets for years to push a malicious extension to an auto-updating base — same mechanism, stolen credential into a short push window.