3,800 GitHub Repos Stolen by One VS Code Extension. Your Cursor Setup Is the Next Attack Surface.

Most coverage frames this as a GitHub story. It is not. GitHub has an incident response team, an isolated employee endpoint, and a corporate EDR stack. They contained it in 24 hours. You don’t have any of that.

The indie hacker stack is uniquely exposed. The average vibe coder is running VS Code + Cursor + Windsurf in parallel, with 20–40 extensions installed across them and approximately zero hours spent auditing any of them. Cursor and Windsurf use the OpenVSX registry, not Microsoft’s marketplace, and OpenVSX has weaker review. Of ~60,000 VS Code marketplace publishers, only ~1,800 are verified. And VS Code extensions run with the same permissions as the editor itself — full filesystem, full network, full process spawning. There is no Android-style permission model. There is no sandbox.

Now consider what’s actually on a solo founder’s laptop: a GitHub PAT (your source code), an Anthropic API key (your AI bill), an OpenAI key (also your bill), an AWS access key (your infrastructure), a Stripe restricted key (your money), a Supabase service role key (your customer data), an npm publish token (your distribution). One compromised extension is a full-stack compromise. That’s exactly what the Nx payload was designed to extract — and the fact that it specifically targeted Claude Code configurations tells you who the threat actor thinks the next batch of victims will be.

TeamPCP — tracked by Google Threat Intelligence Group as UNC6780 — is financially motivated and runs cascading supply-chain attacks. They compromise one package, steal credentials, pivot to the next package, repeat. Their main weapon is the Mini Shai-Hulud worm propagating through npm and PyPI. The Nx Console hit was not an isolated incident:

Watch for OpenVSX hardening. Cursor and Windsurf outsourced their extension marketplace to OpenVSX, which has fewer moderators than Microsoft’s team. Both vendors are now under pressure to either staff up moderation or build their own review pipeline. The editor that gets this right first will become the security-conscious default — and that’s the editor to migrate to.

Watch the Claude Code plugin surface. Anthropic’s plugin model runs unsandboxed with full system privileges, gated only by the Directory Trust dialog. The first malicious Claude Code plugin or MCP server widely distributed via npm is a matter of when, not if. Expect Anthropic to ship plugin signing and a permission model within 90 days.

Watch for TeamPCP’s next pivot. The campaign has moved from build tools (Trivy) to AI middleware (LiteLLM) to npm packages (TanStack) to editor extensions (Nx). The next surface is almost certainly AI coding agent MCP servers, where installations run unsandboxed and tokens flow in from every connected tool. Audit your MCP server list now — don’t wait for the breach writeup.