Topic analysis

1-Click GitHub Token Stealing via a VSCode Bug

A security researcher named Ammaraskar discovered a one-click vulnerability in both the browser-based github.dev (VS Code) and desktop VS Code that allows attackers to steal users' GitHub tokens with full access to public and private repositories. The exploit leverages webview keydown event handling to bypass VS Code's extension publisher trust checks via local workspace extensions, and the researcher opted for public disclosure after a negative prior experience with Microsoft's Security Response Center (MSRC), warning that users who have previously used github.dev are at high risk unless they clear their browser's site data.