Executive brief
A supply chain attack has compromised the Nx Console extension for Visual Studio Code and various GitHub Action workflows. Attackers used a malicious update to the extension to gain access to developer devices and steal internal source code. Additionally, a separate campaign known as 'Megalodon' has been injecting malicious code into GitHub workflows to steal sensitive cloud credentials and security tokens from public repositories.
Technical details
This advisory covers two distinct supply chain intrusion campaigns. In the first, attackers compromised the Nx developer ecosystem to release a poisoned version (18.95.0) of the Nx Console VS Code extension. This malicious version was distributed via the VS Code automatic update mechanism, allowing for unauthorized access to developer machines and the exfiltration of internal GitHub repositories. In the second campaign, dubbed 'Megalodon,' threat actors injected malicious GitHub Action workflows into public repositories. These workflows were designed to harvest CI/CD secrets, cloud credentials (AWS, GCP, Azure), and various authentication tokens. Organizations are advised to audit workflow files, rotate all secrets accessible to CI/CD pipelines, and pin software to specific trusted versions.
Affected products
- Nrwl / Nx Nx Console extension for VS Code 18.95.0
- GitHub GitHub Actions All versions impacted by malicious workflows
Timeline
- 2026-05-18: exploited: Earliest date of unauthorized changes identified in the Megalodon campaign.
- 2026-05-28: advisory: CISA published the alert regarding the supply chain compromises.
- 2026-05-28: kev added: CVE-2026-48027 added to CISA KEV catalog.