# GitHub Codespaces RCE via VS Code Configuration Files

> GitHub Codespaces and VS Code Dev Container configuration files (.devcontainer/devcontainer.json, .vscode/) enable arbitrary code execution when users open repositories containing malicious lifecycle hooks (postCreateCommand, postStartCommand, postAttachCommand), poisoned Dockerfiles, or trojanized extension recommendations — a design-level trust model flaw exploiting developer trust in git clone operations.

- **Published:** 2026-02-16T10:04:13Z
- **Last reviewed:** 2026-02-16T10:04:13Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0100
- **ID:** TL-2026-0100
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

GitHub Codespaces provides cloud-based development environments using the Dev Container specification. The devcontainer.json configuration file supports 6 lifecycle hooks that execute arbitrary shell commands at different container stages: initializeCommand (runs on host before container creation), onCreateCommand, updateContentCommand, postCreateCommand, postStartCommand, and postAttachCommand. When a developer opens a Codespace from a repository containing malicious configuration files, these commands execute automatically without explicit user consent beyond the initial Codespace creation action. The attack surface extends across three vectors: (1) Lifecycle Hook Abuse — malicious postCreateCommand/postStartCommand entries in devcontainer.json execute arbitrary shell commands during container setup. GitHub's own security documentation warns that devcontainer.json 'can contain powerful features, such as installing third-party extensions and running arbitrary code supplied in a postCreateCommand.' (2) Malicious Dockerfile Injection — the .devcontainer/Dockerfile controls the entire container image build, allowing malware installation, backdoor deployment, or credential theft during image construction. (3) VS Code Extension Supply Chain — the customizations.vscode.extensions array in devcontainer.json auto-installs extensions that run with full user privileges without any sandbox. Aqua Nautilus (2023) demonstrated that VS Code Marketplace extensions can be trivially impersonated via typosquatting and displayName spoofing — their Prettier impersonation PoC received 1,000+ installations within 48 hours. The 'verified publisher' badge only confirms domain ownership, not identity. Additionally, Trend Micro (January 2023) demonstrated that Codespaces' public port forwarding feature can be weaponized to create ephemeral malware delivery infrastructure on legitimate github.dev domains, bypassing reputation-based detection. Supply chain attack vectors include: forked repositories with modified .devcontainer/ configs, pull requests injecting devcontainer changes, template repositories distributing malicious configurations, and dependency confusion via Dev Container Features from untrusted registries. Organizational controls exist but are opt-in: GitHub provides policies for base image restriction, port visibility limitation, and machine type access — but individual developers and free accounts have no such guardrails. The fundamental trust model flaw: developers trust 'git clone' and 'Open in Codespace' as safe operations, but devcontainer.json transforms repository opening into arbitrary code execution.

## MITRE ATT&CK

- T1059 Command and Scripting Interpreter
- T1059.004 Unix Shell
- T1059.006 Python
- T1204.002 Malicious File
- T1546 Event Triggered Execution
- T1037 Boot or Logon Initialization Scripts
- T1195.001 Compromise Software Dependencies and Development Tools
- T1195.002 Compromise Software Supply Chain
- T1199 Trusted Relationship
- T1036 Masquerading
- T1036.005 Match Legitimate Resource Name or Location
- T1553 Subvert Trust Controls
- T1552.001 Credentials In Files
- T1528 Steal Application Access Token
- T1080 Taint Shared Content
- T1005 Data from Local System
- T1608.001 Upload Malware
- T1583.006 Web Services
- T1071.001 Web Protocols
- T1567 Exfiltration Over Web Service
- T1195 Supply Chain Compromise
- T1204.001 Malicious Link
- T1137 Office Application Startup
- T1552.004 Private Keys
- T1059.001 PowerShell
- T1078 Valid Accounts
- T1098 Account Manipulation
- T1548 Abuse Elevation Control Mechanism
- T1496 Resource Hijacking
- T1213.003 Code Repositories

## Sources

- [Trend Micro: Abusing a GitHub Codespaces Feature For Malware Delivery](https://www.trendmicro.com/en_us/research/23/a/abusing-github-codespaces-for-malware-delivery.html)
- [Aqua Nautilus: Can You Trust Your VSCode Extensions?](https://www.aquasec.com/blog/can-you-trust-your-vscode-extensions/)
- [GitHub Docs: Security in GitHub Codespaces](https://docs.github.com/en/codespaces/reference/security-in-github-codespaces)
- [GitHub Docs: Introduction to Dev Containers](https://docs.github.com/en/codespaces/setting-up-your-project-for-codespaces/adding-a-dev-container-configuration/introduction-to-dev-containers)
- [Dev Container Specification: JSON Reference](https://containers.dev/implementors/json_reference/)
- [GitHub Docs: Restricting Base Image for Codespaces](https://docs.github.com/en/codespaces/managing-codespaces-for-your-organization/restricting-the-base-image-for-codespaces)
- [GitHub Docs: Restricting Visibility of Forwarded Ports](https://docs.github.com/en/codespaces/managing-codespaces-for-your-organization/restricting-the-visibility-of-forwarded-ports)
- [VS Code Marketplace: Dev Containers Extension (ms-vscode-remote.remote-containers)](https://marketplace.visualstudio.com/items?itemName=ms-vscode-remote.remote-containers)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0100