Malware attach

Type: Bug

I am using vscode for coding, I connected claude code for development, when I connected vscode with my github, it asks to allow for some permissions include edit workflows , so I did so, but after few hours, my coulleage reported me that you have pushed some changes in .github workflow folder like some sh files, I said No, I did not , then I realized that I recently only vscode connected with github.

VS Code version: Code 1.130.0 (1b6a188127eeaf9194f945eb6eb89a657e93c54c, 2026-07-22T14:55:04Z)
OS version: Windows_NT x64 10.0.26200
Modes:

System Info

|Item|Value|
|---|---|
|CPUs|13th Gen Intel(R) Core(TM) i5-1334U (12 x 2496)|
|GPU Status|2d_canvas: enabled
GPU0: VENDOR= 0x8086, DEVICE=0xa7a1 [Intel(R) Iris(R) Xe Graphics], DRIVER_VENDOR=Intel, DRIVER_VERSION=32.0.101.7076 *ACTIVE*
GPU1: VENDOR= 0x1414, DEVICE=0x008c [Microsoft Basic Render Driver], DRIVER_VERSION=10.0.26100.8972
Machine model name:
Machine model version:
direct_rendering_display_compositor: disabled_off_ok
gpu_compositing: enabled
multiple_raster_threads: enabled_on
opengl: enabled_on
rasterization: enabled
raw_draw: disabled_off_ok
skia_graphite: disabled_off
trees_in_viz: disabled_off
video_decode: enabled
video_encode: enabled
webgl: enabled
webgpu: enabled
webnn: disabled_off|
|Load (avg)|undefined|
|Memory (System)|23.65GB (4.18GB free)|
|Process Argv|--crash-reporter-id 50f17f45-20cc-4dcb-a3ac-9a17902a4559|
|Screen Reader|no|
|VM|0%|
Extensions (8)

Name|Identifier|Author|Version
---|---|---|---
Angular Files|alexiv.vscode-angular2-files|alexiv|1.6.4
Angular Language Service|angular.ng-template|Angular|22.0.1
Claude Code for VS Code|anthropic.claude-code|Anthropic|2.1.221
PHP Intelephense|bmewburn.vscode-intelephense-client|bmewburn|1.18.5
Python Debugger|ms-python.debugpy|ms-python|2026.6.0
Python|ms-python.python|ms-python|2026.4.0
Pylance|ms-python.vscode-pylance|ms-python|2026.3.1
Python Environments|ms-python.vscode-python-envs|ms-python|1.36.0

A/B Experiments

```
vsliv368cf:30146710
binariesv615:30325510
nativeloc1:31344060
dwcopilot:31170013
dwoutputs:31242946
copilot_t_ci:31333650
e5gg6876:31282496
pythonrdcb7:31342333
6518g693:31463988
aj953862:31281341
envsactivate1:31551504
cloudbuttont:31379625
3efgi100_wstrepl:31403338
ec5jj548:31422691
cp_cls_t_966_ss:31526232
4je02754:31466945
c3h7c220:31478652
cp_cls_t_1081:31454832
conptydll_true:31498968
e9c30283:31461165
test_treatment2:31471001
46204921:31447328
idci7584:31464702
e3e4d672:31494082
ei9d7968:31496641
nes-extended-on:31455476
chat:31457767
8hig5102:31480529
89g7j272:31518289
7e187181:31503455
i2gc6536:31499202
52612955:31516516
ghj88844:31499326
ddid_t:31478206
hmra_i5g22:31518061
7df3h592:31512476
cp_cls_t_1082:31535311
logging_enabled_new:31498466
j0d79568:31499440
jb_cp_cls_t_632:31543129
56dj4588:31512888
32d76977:31512328
ha629193:31508444
cdk-lw-on:31524445
f9bf7985:31543584
jh5f2457_c:31540921
g4a0e106:31529594
41836166:31537719
jbcp_cls_pctr_t:31531130
61138546:31518536
cp_intellij_t_nes:31548657
d7b18187:31526828
nes-curr-leftover-1500:31538366
ahp-both-windows:31556933
h561g132:31533256
sessions_3:31532893
ihg5j128:31534457
f412h606:31551416
9gg7f176:31542112
5fe6f778:31554331
allow-none:31555437
fd5dc207:31551400
nes-gb3-nf-5k:31554345
8hc4g144:31558143
0dg73464:31554319
d4c76da2:31557006
treatment-23-1:31555779
unuse_dynamic_mcp:31555281

```