isc.sans.edu 5/25/2026, 2:41:29 PM · external

VS Code Extension Hack

VS Code Extension Hack
CyberSIXT Evidence Panel
Primary Source microsoft.com
Threat Actor

THE content discusses the TeamPCP supply chain campaign impacting various development ecosystems, particularly GitHub, npm packages, and a Microsoft Python SDK. Key incidents included: 1) A malicious Nx Console VS Code extension led to a significant GitHub breach, exfiltrating around 3,800 repositories. 2) The trojanization of Microsoft's official 'durabletask' SDK, which carried a payload described as a Linux disk wiper.

3) A large-scale npm attack involved 639 malicious package versions affecting popular libraries, with some displaying forged verification badges. The discussion emphasizes rotating credentials, the risks of relying on verification badges, and the continuing impact of the campaign with reports of copied malicious frameworks appearing on GitHub.

View Primary Source Via isc.sans.edu

Article by CyberSIXT

Timeline Coverage

Swipe to explore timeline