GitHub internal repositories. The access path.
A poisoned editor extension harvested developer credentials, an AI agent config among them. The credential list now includes the file your coding agent keeps its configuration in.
The record
Entry point. the Nx Console extension, a malicious version published to the marketplace for a few minutes.
The identity in the middle. GitHub personal access tokens, npm and OIDC tokens, AWS credentials, vault access, and the contents of an AI coding agent settings file, all taken from developer machines.
What was reached. GitHub internal repositories, GitHub states the activity involved internal repositories only; the attacker claimed about 3,800.
A poisoned editor extension harvested developer credentials, an AI agent config among them.
The path, step by step.
Taken from the published reporting. Nothing here is reconstructed.
| Step | Role in the path | What the reporting records |
|---|---|---|
| the Nx Console extension | Entry | a malicious version published to the marketplace for a few minutes |
| developer workstation | Step | a credential harvester matching tokens, cloud credentials and the AI agent settings file |
| harvested tokens | Step | exfiltrated over HTTPS, the GitHub API and DNS tunnelling |
| GitHub internal repositories | Reached | GitHub states the activity involved internal repositories only; the attacker claimed about 3,800 |
Where a breakpoint would have been
Where agent credentials live. Editor extensions run with the developer full access, which makes the marketplace an identity supply chain. A harvester that already knows to read agent settings files means those files need the handling of a cloud credential, not the handling of a preference.
A breakpoint is the single change that closes a path with the least disruption. Read how that is chosen in the breakpoint page. The full narrative is in the teardown.
4 steps from entry to data.
Where this comes from.
Every field on this page is taken from the published reporting below. The breakpoint assessment is Elmoz reading that path, not a statement about what the affected organisation did.
Questions, answered.
The two questions this record answers.
What was the entry point in the GitHub internal repositories incident?
The published path starts at the Nx Console extension, a malicious version published to the marketplace for a few minutes.
What did it reach?
The last step in the published path is GitHub internal repositories, GitHub states the activity involved internal repositories only; the attacker claimed about 3,800.
Other incidents.
Same database, different path shape.
See what your agents can reach. Before someone else does.
Book a demo and we walk through the access paths in an environment like yours.