Supply Chain Compromises Impact Nx Console and GitHub Repositories

CISA reports multiple supply chain attacks targeting developer ecosystems and CI/CD pipelines. Threat actors compromised Nx developer systems and used a malicious Nx Console VS Code extension (version 18.95.0) to compromise a GitHub employee's device, leading to unauthorized access and data exfiltration from internal GitHub repositories. A separate campaign called 'Megalodon' involved injecting malicious GitHub Action workflows to harvest CI/CD secrets, cloud credentials, and tokens from public repositories. The malicious extension was distributed through VS Code's automatic update mechanism, affecting systems without manual intervention. CVE-2026-48027 has been assigned and added to CISA's Known Exploited Vulnerabilities Catalog.