Supply Chain Compromises Impact Nx Console and GitHub Repositories

CISA warns of active software supply chain intrusion campaigns impacting developer ecosystems, including a malicious Nx Console VS Code extension (malicious build 18.95.0, CVE-2026-48027) that was distributed via automatic updates and was used to compromise a GitHub employee device and exfiltrate internal repositories. Separately, the “Megalodon” campaign injected malicious GitHub Action workflows into public repositories to harvest CI/CD secrets, cloud credentials, and tokens. CISA also added multiple vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of in