Supply Chain Compromises Impact Nx Console and GitHub Repositories

CISA alerts that multiple software supply chain intrusion campaigns are actively targeting developer ecosystems and CI/CD pipelines. Threat actors used a compromised Nx developer system to distribute a malicious Nx Console VS Code extension (v18.95.0) via VS Code’s auto-update, which led to compromise of a GitHub employee device and exfiltration of internal GitHub repositories; CVE-2026-48027 has been assigned and added to CISA’s Known Exploited Vulnerabilities (KEV) Catalog. Separately, the “Megalodon” campaign injected malicious GitHub Action workflows into public repositories to harvest CI