[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fv_KxA95uWbnnqUr5523JCucBthZtb-s8F1dFwfDR6wE":3},{"article":4,"iocs":54},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":34,"category":35,"article_tags":38},"35475046-2547-4268-830b-d7b78c325d80","Supply Chain Compromises Impact Nx Console and GitHub Repositories","supply-chain-compromises-impact-nx-console-and-github-repositories-48d82e","CISA is prioritizing the response to multiple emerging software supply chain intrusion campaigns targeting developer ecosystems Continuous Integration\u002FContinuous Development (CI\u002FCD) pipelines. These recent incidents, including the GitHub compromise via a malicious Nx Console Visual Studio Code (VS Code) extension and the “Megalodon” supply chain intrusion campaign, demonstrate how cyber threat actors are abusing tools and processes that support enterprise, cloud, and DevOps environments—specifically CI\u002FCD pipelines, code extensions and workflows. Threat actors leveraged a prior compromise of Nx developer systems to compromise a GitHub employee’s device through a poisoned third-party VS Code extension, resulting in unauthorized access and exfiltration of internal GitHub repositories. The malicious extension version (18.95.0) was distributed through VS Code’s automatic update mechanism, meaning systems with Nx Console previously installed may have received the malicious build without developers taking any manual installation action. GitHub released a security advisory on this activity, and CVE-2026-48027 has been assigned to the malicious version of Nx Console and added to CISA’s Known Exploited Vulnerabilities (KEV) Catalog. Additionally, in a campaign known as “Megalodon,” a cyber threat actor injected malicious GitHub Action workflows to harvest CI\u002FCD secrets, cloud credentials, and tokens, impacting both development and deployment pipelines in public GitHub repositories. CISA urges organizations to implement the following recommendations to detect and remediate a potential compromise: Monitor and audit workflow files and contributor activity for suspicious pull requests and direct commits, particularly those authored by automated accounts. Revert unauthorized changes, especially from automated accounts, e.g., build-bot, auto-ci, ci-bot, pipeline-bot and especially those made after May 18, 2026. If your organization discovers a compromise resulting from previously compromised GitHub or Nx Console software, CISA recommends the following steps: Conduct a forensics review of CI\u002FCD logs, cloud audit trails, and affected developer machines. Rotate\u002Frevoke all secrets including: all credentials, tokens, and secrets accessible to CI\u002FCD pipelines, including API keys, cloud provider credentials (Amazon Web Services, Google Cloud Platform, Microsoft Azure), SSH keys, Docker\u002Fnpm\u002FPyPI\u002FVault\u002FTerraform\u002FKubernetes tokens, GitHub\u002FGitLab\u002FBitbucket tokens, and developer or pipeline secrets. Notify proper stakeholders if necessary. CISA recommends the following best practices for using package repos: Wait at least three hours before pulling a new package. This gives the software community time to identify suspicious or malicious packages before they are widely downloaded. Pin software to specific trusted versions. Pinning software prevents pulling a malicious or unscreened package during the build process. Only pull packages from known and trusted sources. Relying on known and trusted sources reduces the likelihood of downloading a package that has been maliciously forked. See the following resources for additional guidance on these compromises: GitHub: Investigating unauthorized access to GitHub-owned repositories Nx: Postmortem: Nx Console v18.95.0 supply-chain compromise Ox Security: Megalodon: CI\u002FCD Malware Spreading Across GitHub Repositories StepSecurity: Nx Console VS Code Extension Compromised SafeDep: Megalodon: Mass GitHub Repo Backdooring via CI Workflows Disclaimer The information in this report is being provided “as is” for informational purposes only. CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA.","CISA issued a priority alert on multiple supply chain intrusion campaigns targeting developer ecosystems, including a poisoned Nx Console VS Code extension (v18.95.0, CVE-2026-48027) that compromised a GitHub employee's device and exposed internal repositories, plus the \"Megalodon\" campaign injecting malicious GitHub Action workflows to harvest CI\u002FCD secrets and cloud credentials. The malicious Nx extension was distributed via automatic VS Code updates, affecting systems without manual user action, and organizations are advised to audit CI\u002FCD workflows, rotate credentials, and implement package pinning practices.","Malicious Nx Console VS Code extension and Megalodon campaign compromise GitHub and CI\u002FCD pipelines.","Alert Supply Chain Compromises Impact Nx Console and GitHub Repositories Release DateMay 28, 2026 CISA is prioritizing the response to multiple emerging software supply chain intrusion campaigns targeting developer ecosystems Continuous Integration\u002FContinuous Development (CI\u002FCD) pipelines. These recent incidents, including the GitHub compromise via a malicious Nx Console Visual Studio Code (VS Code) extension and the “Megalodon” supply chain intrusion campaign, demonstrate how cyber threat actors are abusing tools and processes that support enterprise, cloud, and DevOps environments—specifically CI\u002FCD pipelines, code extensions and workflows. Threat actors leveraged a prior compromise of Nx developer systems to compromise a GitHub employee’s device through a poisoned third-party VS Code extension, resulting in unauthorized access and exfiltration of internal GitHub repositories. The malicious extension version (18.95.0) was distributed through VS Code’s automatic update mechanism, meaning systems with Nx Console previously installed may have received the malicious build without developers taking any manual installation action. GitHub released a security advisory on this activity, and CVE-2026-48027 has been assigned to the malicious version of Nx Console and added to CISA’s Known Exploited Vulnerabilities (KEV) Catalog. Additionally, in a campaign known as “Megalodon,” a cyber threat actor injected malicious GitHub Action workflows to harvest CI\u002FCD secrets, cloud credentials, and tokens, impacting both development and deployment pipelines in public GitHub repositories. CISA urges organizations to implement the following recommendations to detect and remediate a potential compromise: Monitor and audit workflow files and contributor activity for suspicious pull requests and direct commits, particularly those authored by automated accounts. Revert unauthorized changes, especially from automated accounts, e.g., build-bot, auto-ci, ci-bot, pipeline-bot and especially those made after May 18, 2026. If your organization discovers a compromise resulting from previously compromised GitHub or Nx Console software, CISA recommends the following steps: Conduct a forensics review of CI\u002FCD logs, cloud audit trails, and affected developer machines. Rotate\u002Frevoke all secrets including: all credentials, tokens, and secrets accessible to CI\u002FCD pipelines, including API keys, cloud provider credentials (Amazon Web Services, Google Cloud Platform, Microsoft Azure), SSH keys, Docker\u002Fnpm\u002FPyPI\u002FVault\u002FTerraform\u002FKubernetes tokens, GitHub\u002FGitLab\u002FBitbucket tokens, and developer or pipeline secrets. Notify proper stakeholders if necessary. CISA recommends the following best practices for using package repos: Wait at least three hours before pulling a new package. This gives the software community time to identify suspicious or malicious packages before they are widely downloaded. Pin software to specific trusted versions. Pinning software prevents pulling a malicious or unscreened package during the build process. Only pull packages from known and trusted sources. Relying on known and trusted sources reduces the likelihood of downloading a package that has been maliciously forked. See the following resources for additional guidance on these compromises: GitHub: Investigating unauthorized access to GitHub-owned repositories Nx: Postmortem: Nx Console v18.95.0 supply-chain compromise Ox Security: Megalodon: CI\u002FCD Malware Spreading Across GitHub Repositories StepSecurity: Nx Console VS Code Extension Compromised SafeDep: Megalodon: Mass GitHub Repo Backdooring via CI Workflows Disclaimer The information in this report is being provided “as is” for informational purposes only. CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA. This product is provided subject to this Notification and this Privacy & Use policy. Please share your thoughts We recently updated our anonymous product survey; we welcome your feedback.","https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Falerts\u002F2026\u002F05\u002F28\u002Fsupply-chain-compromises-impact-nx-console-and-github-repositories",null,"2026-05-28T12:00:00+00:00","2026-05-28T20:00:18.67574+00:00",9,[18,21,23,26,29,32],{"name":19,"type":20},"Nx Console","product",{"name":22,"type":20},"Visual Studio Code",{"name":24,"type":25},"GitHub","vendor",{"name":27,"type":28},"Megalodon","campaign",{"name":30,"type":31},"CI\u002FCD pipelines","technology",{"name":33,"type":25},"CISA","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":34,"icon":13,"name":36,"slug":37},"Supply Chain","supply-chain",[39,44,49],{"category":40},{"id":41,"icon":13,"name":42,"slug":43},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":45},{"id":46,"icon":13,"name":47,"slug":48},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":50},{"id":51,"icon":13,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,59],{"type":56,"value":57,"context":58},"cve","CVE-2026-48027","Malicious Nx Console VS Code extension v18.95.0 supply chain attack",{"type":48,"value":27,"context":60},"CI\u002FCD malware campaign injecting malicious GitHub Action workflows to harvest secrets"]