A malicious update to the Nx Console VS Code extension gave attackers a path into GitHub's own internal repositories.
Attackers first compromised systems belonging to Nx, the JavaScript build-tooling project, then used that access to push a poisoned version — 18.95.0 — of the Nx Console extension. VS Code's automatic update mechanism delivered the malicious build silently to anyone who already had the extension installed; no developer had to click anything. Once on a GitHub employee's machine, the extension gave attackers enough footing to exfiltrate internal GitHub repositories. The incident has been assigned CVE-2026-48027 and added to CISA's Known Exploited Vulnerabilities catalog.
The attack chain is worth studying closely: a build-tool vendor's compromise became a GitHub employee's compromise became a GitHub infrastructure breach, with no phishing link required. Running in parallel, a separate campaign called "Megalodon" injected malicious GitHub Actions workflows into public repositories to harvest CI/CD secrets, cloud credentials, and API tokens across both development and deployment pipelines. Together, these two incidents confirm that the developer toolchain is now a primary target, not a secondary one.
CISA recommends waiting three hours before pulling new packages and pinning software to specific versions — sensible hygiene, though neither measure would have helped anyone who already had Nx Console installed and received the poisoned build automatically.