▶ YouTube Summaries

• https://www.youtube.com/watch?v=XKA94rcu8b8
• Original title: This is bad...

GitHub confirmed unauthorized access to its internal repos after a Microsoft employee installed a poisoned NX Console VS Code extension. Attackers exfiltrated ~3,800 internal repos. Theo unpacks the mechanism (VS Code marketplace + auto-update + stolen maintainer token), connects it to the ongoing Shai-Hulud / mini-shy npm wave, and argues Microsoft's marketplace, npm trusted-publishing story, and no-takedown policies are structurally broken.

What happened

• GitHub detected compromise of an employee device via a poisoned VS Code extension; isolated endpoint, rotated critical secrets.
• Attacker claim of 3,800 exfiltrated internal repos "directionally consistent" with GitHub's findings.
• Narwhal CEO later confirmed the vector was the NX Console VS Code extension (2.2M installs, verified publisher badge).
• Malicious version uploaded 2026-05-18 12:30 UTC, unpublished ~18 min later on Marketplace, 36 min on Open VSX.

Root cause

• NX maintainer's GitHub token was scraped during the earlier Shai-Hulud npm supply-chain wave, then reused to publish the malicious extension.
• Once a victim auto-updated, the extension exfiltrated local tokens, SSH keys, secrets — anything on disk credentials-adjacent.
• Maintainer didn't receive Marketplace upload notification email until 6 min after publish; Microsoft did not flag.

Why npm's "trusted publishing" cope doesn't help

• npm invalidated granular access tokens that bypassed 2FA, told users to switch to trusted publishing.
• Most compromised packages already used trusted publishing.
• GitHub Actions cache poisoning (e.g. pull_request_target vs pull_request misuse, as with Tanstack) lets attackers inject malware through the trusted pipeline.

Auto-update is now the attack surface

• VS Code: 12h fallback timer (1h insiders), immediate check on startup, sync on any gallery interaction (sidebar open, search, recommendation), throttled install ~1s.
• A 18-minute publish window across timezones with sidebars open = massive blast radius.
• Async API extension (Nov 2025, Shai-Hulud first-blood) kept compromising ~100–200 new repos/day for a month until a clean v102 forced upgrades past malicious v101.
• Auto-update on by default everywhere: VS Code, Cursor, Chrome extensions, etc.

Socket / Aikido vs Microsoft

• Socket just raised $60M Series C at $1B (only ~6% sale — flex, not need).
• Small firms detect these attacks before Microsoft, npm or GitHub do.
• Microsoft hasn't given them a takedown button or even direct comms; people resort to 2AM DMs.

Theo's proposed fixes

• Auto-analyse updates to popular packages/extensions (threshold by install or download count) with a cheap agent pass before propagation.
• Staging window: don't auto-install brand-new versions for N minutes/hours; manual opt-in only.
• Real takedown flow on npm — currently impossible to unpublish; should be reversible within an hour with a "malicious" flag.
• Push notifications to installers when a compromised version is yanked; registry of bad version hashes checked on every install.
• Email maintainer immediately on publish (not 6 min later).
• 12h delay on auto-updates would alone kill most of the attacker incentive.

Theo's framing

• Hackers are sitting on giant pools of leaked tokens from Shai-Hulud and likely running agents to find more reusable creds — expect more attacks for months even after current fixes.
• Microsoft owns the whole arena (GitHub + npm + VS Code Marketplace + Open VSX) and keeps lighting fires inside it.
• NX team taking responsibility is generous — Theo says the structural blame is on Microsoft.
• "Wake the fuck up, Microsoft. This goes way beyond the slow death of GitHub — this is going to kill all of software."