Multiple campaigns compromised CI/CD pipelines through malicious VS Code extensions and GitHub Actions workflows.
- Malicious Nx Console VS Code extension compromised GitHub employee device and internal repositories
- ‘Megalodon’ campaign injected malicious GitHub Action workflows to steal CI/CD secrets and credentials
- CISA urges organisations to audit workflow files and revert unauthorised automated account changes
CISA has issued an alert warning of multiple supply chain intrusion campaigns targeting developer ecosystems and CI/CD pipelines, following significant compromises affecting GitHub and widely-used development tools.
The first incident involved threat actors who leveraged a prior compromise of Nx developer systems to distribute a malicious version of the Nx Console Visual Studio Code extension. The poisoned extension (version 18.95.0) was automatically pushed to systems through VS Code’s update mechanism, requiring no manual action from developers.
This malicious extension compromised a GitHub employee’s device, resulting in unauthorised access to and exfiltration of internal GitHub repositories. CVE-2026-48027 has been assigned to the malicious Nx Console version and added to CISA’s Known Exploited Vulnerabilities Catalog.
In a separate campaign dubbed ‘Megalodon,’ cyber threat actors injected malicious GitHub Action workflows into public repositories to harvest CI/CD secrets, cloud credentials, and tokens. This campaign impacted both development and deployment pipelines across multiple organisations.
The attacks demonstrate how threat actors are increasingly targeting the tools and processes that support enterprise, cloud, and DevOps environments. By compromising CI/CD pipelines and code extensions, attackers can gain access to sensitive credentials and internal systems at scale.
CISA recommends organisations immediately monitor and audit workflow files and contributor activity for suspicious pull requests and direct commits, particularly those authored by automated accounts. Special attention should be paid to changes made by accounts with names like build-bot, auto-ci, ci-bot, and pipeline-bot, especially those made after 18 May 2026.
Why It Matters
These supply chain attacks highlight a critical blind spot in enterprise security architectures. CI/CD pipelines and developer tools often have elevated privileges and access to production systems, making them high-value targets. The automatic distribution of malicious extensions through trusted update mechanisms bypasses traditional security controls and user awareness.
For CISOs, this represents both an immediate operational risk requiring urgent remediation and a strategic wake-up call about supply chain visibility. Board discussions should focus on third-party risk management, developer toolchain security, and the organisation’s ability to rapidly detect and respond to supply chain compromises.
What To Do Now
- Immediately audit all GitHub repositories for unauthorised workflow changes, particularly from automated accounts after 18 May 2026, as recommended by CISA
- Check for Nx Console VS Code extension version 18.95.0 and remove if present, following CISA’s remediation guidance
- Review and rotate CI/CD secrets, cloud credentials, and tokens that may have been exposed through compromised workflows
- Implement enhanced monitoring for suspicious pull requests and direct commits to critical repositories
