Supply Chain Compromises Impact Nx Console and GitHub Repositories

p CISA is prioritizing the response to multiple emerging software supply chain intrusion campaigns targeting developer ecosystems Continuous Integration/Continuous Development (CI/CD) pipelines. These recent incidents, including the GitHub compromise via a malicious Nx Console Visual Studio Code (VS Code) extension and the “Megalodon” supply chain intrusion campaign, demonstrate how cyber threat actors are abusing tools and processes that support enterprise, cloud, and DevOps environments—specifically CI/CD pipelines, code extensions and workflows. nbsp; /p p Threat actors leveraged a prior compromise of Nx developer systems to compromise a GitHub employee’s device nbsp;through a poisoned third-party VS Code extension, resulting in unauthorized access and exfiltration of internal GitHub repositories. The malicious extension version (18.95.0) was distributed through VS Code’s automatic update mechanism, meaning systems with Nx Console previously installed may have received the malicious build without developers taking any manual installation action. GitHub released a a href="https://github.com/nrwl/nx-console/security/advisories/GHSA-c9j4-9m59-847w" target="_blank" security advisory /a on this activity, and a href="https://www.cve.org/CVERecord?id=CVE-2026-48027" target="_blank" CVE-2026-48027 /a has been assigned to the malicious version of Nx Console and added to a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog" CISA’s Known Exploited Vulnerabilities (KEV) Catalog /a . /p p Additionally, in a campaign known as “Megalodon,” a cyber threat actor injected malicious GitHub Action workflows to harvest CI/CD secrets, cloud credentials, and tokens, impacting both development and deployment pipelines in public GitHub repositories. /p p CISA urges organizations to implement the following recommendations to detect and remediate a potential compromise: /p ul li Monitor and audit workflow files and contributor activity for suspicious pull requests and direct commits, particularly those authored by automated accounts. /li li Revert unauthorized changes, especially from automated accounts, e.g., code build-bot /code , code auto-ci /code , code ci-bot /code , code pipeline-bot /code and especially those made after May 18, 2026. /li /ul p If your organization discovers a compromise resulting from previously compromised GitHub or Nx Console software, CISA recommends the following steps: /p ul type="square" li Conduct a forensics review of CI/CD logs, cloud audit trails, and affected developer machines. nbsp; /li li Rotate/revoke all secrets including: all credentials, tokens, and secrets accessible to CI/CD pipelines, including API keys, cloud provider credentials (Amazon Web Services, Google Cloud Platform, Microsoft Azure), SSH keys, Docker/npm/PyPI/Vault/Terraform/Kubernetes tokens, GitHub/GitLab/Bitbucket tokens, and developer or pipeline secrets. nbsp; /li li Notify proper stakeholders if necessary. /li /ul p CISA recommends the followin