VS Code extension attack compromises GitHub, OpenAI, and Mistral AI

A VS Code extension supply chain attack compromised GitHub, OpenAI, and Mistral AI, exposing thousands of internal repositories and developer credentials. The breach originated from a poisoned Nx Console extension, itself a victim of the TanStack npm attack. Threat actor TeamPCP used harvested credentials to access internal repositories. The malicious extension was active for 18 minutes on May 18, 2026, targeting developer credentials for various services. No customer data outside internal repositories is believed to be affected at GitHub.