Poisoned Pipeline / Incidents / AS168

AS168 · 2026-03

Fake VS Code security-alert GitHub malware campaign

Git / GitHubVS Code / IDE

Socket: widespread GitHub campaign uses fake VS Code security alerts to deliver malware.

Mapped techniques

• T0110 Advertise malicious artifact
• T0111 Malicious code contribution to an open-source repository

supply-chain campaign

Sources

• https://socket.dev/blog/widespread-github-campaign-uses-fake-vs-code-security-alerts-to-deliver-malware