Preliminary research
Stealing GitHub tokens via VS Code webview keyboard event bubbling
1-Click GitHub Token Stealing via a VSCode Bug
AI-collected research leads through 22 September 2026, including targeted additions between broader sweeps. Unranked, incomplete, not community-vetted, and subject to change.
VSCode webviews are cross-origin iframes, but to keep shortcuts working they forward their own keydown events to the host over postMessage, and the host cannot tell a synthetic event from a real keypress. Javascript in a notebook cell sends Ctrl+Shift+A to accept the recommended-extension prompt, installing a local workspace extension whose keybinding calls installExtension with skipPublisherTrust, and that extension reads github.dev's unscoped GitHub token.
Record
- Document
- 1-Click GitHub Token Stealing via a VSCode Bug
- Researcher
- Ammar Askar
- Published by
- Ammar's Blog
- Topic
- Other
In the archive
Related sources
- https://github.com/ammaraskar/vscode-github-token-grab-extension/blob/main/src/extension.ts
- https://github.com/ammaraskar/github-dev-token-steal-poc/blame/main/README.ipynb
- VSCode issue tracker
Tags
This page is the archive's own catalogue record. The research is the work of Ammar Askar, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .