GitHub confirms compromised Nx Console extension was initial access vector

A stolen developer credential enabled attackers to publish a malicious Nx Console VS Code extension, which served as the initial access vector for a sophisticated supply chain attack that breached GitHub’s internal repositories, exfiltrated sensitive credentials, and facilitated a public auction of stolen source code.