One-Click GitHub Dev Attack Lets Attackers Steal Full GitHub OAuth Tokens

The vulnerability exploits GitHub.dev's web-based VS Code environment by leveraging malicious VS Code extensions that steal GitHub OAuth tokens. The attack works by exploiting message-passing mechanisms between the main VS Code window and webviews, using malicious JavaScript to simulate keypresses (keydown events), opening the Command Palette via Ctrl+Shift+P, and installing attacker-controlled extensions. The exploit bypasses security checks by using local workspace extensions feature, placing malicious extensions in the .vscode/extensions folder to avoid publisher trust dialogs. The stolen OAuth tokens have full access to all repositories the victim can access, not just the specific repo being viewed.