Poisoned Nx Console extension breaches GitHub repos

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

Supply chain attacks via malicious Nx Console VS Code extension compromised GitHub employee systems and Megalodon campaign injected malicious workflows to steal CI/CD secrets from public repositories.

Sourcecisa.gov — open the original

CISA is responding to multiple software supply chain intrusion campaigns targeting developer ecosystems and CI/CD pipelines. Threat actors compromised Nx developer systems and used a poisoned Nx Console Visual Studio Code extension (version 18.95.0) to compromise a GitHub employee's device, resulting in unauthorized access and exfiltration of internal GitHub repositories. The malicious extension was distributed through VS Code's automatic update mechanism, potentially affecting all systems with Nx Console previously installed without requiring manual user action.

In a separate but related campaign dubbed Megalodon, threat actors injected malicious GitHub Action workflows into public repositories to harvest CI/CD secrets, cloud credentials, and tokens, impacting both development and deployment pipelines. This campaign demonstrates systematic abuse of CI/CD automation to compromise software supply chains at scale.

CISA recommends organizations audit workflow files and contributor activity for suspicious commits from automated accounts, particularly those made after May 18, 2026. Affected organizations should conduct forensic reviews of CI/CD logs and cloud audit trails, rotate all credentials and secrets accessible to CI/CD pipelines, and implement best practices including waiting three hours before pulling new packages and pinning software to specific trusted versions.

title: Suspicious Child Process Spawned from VS Code Extension Host
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \Code.exe
    - \Code - Insiders.exe
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
    - \cmd.exe
    - \wscript.exe
    - \cscript.exe
    - \curl.exe
    - \certutil.exe
    - \mshta.exe
  filter:
    CommandLine|contains:
    - --version
    - git rev-parse
    - node_modules\.bin
  condition: selection and not filter
falsepositives:
- Legitimate VS Code extensions that shell out to git, npm, or build tools during
  normal development
- Integrated terminal usage inside VS Code launching interpreters directly
level: medium
tags:
- attack.t1554
- attack.t1195.002
id: eeef7038-afd0-5abb-91e1-80af10deb2f1
status: experimental
author: Vorant

title: Environment Variable Dump Piped to Network Utility
logsource:
  category: process_creation
  product: linux
detection:
  selection_env:
    CommandLine|contains:
    - env
    - printenv
    - export -p
  selection_net:
    CommandLine|contains:
    - curl
    - wget
    - 'nc '
  selection_pipe:
    CommandLine|contains: '|'
  condition: selection_env and selection_net and selection_pipe
falsepositives:
- Legitimate CI/CD debugging scripts that intentionally log environment state to a
  monitoring endpoint
- Configuration management tools that dump environment variables to internal logging
  services
level: high
tags:
- attack.t1528
- attack.t1195.001
id: 31367486-9d07-56e8-8861-5c103ab7eac0
status: experimental
author: Vorant

title: Suspicious GitHub Actions Workflow File Modification
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains: /.github/workflows/
    TargetFilename|endswith:
    - .yml
    - .yaml
  selection_content_marker:
    TargetFilename|contains:
    - curl
    - base64
    - wget
  condition: selection_path and selection_content_marker
falsepositives:
- Legitimate workflows that download build artifacts or dependencies from trusted
  package registries
- CI pipelines that use base64 encoding for legitimate binary artifact transport
level: medium
tags:
- attack.t1195.001
- attack.t1195.002
- attack.t1213.003
id: 9b38b079-8f26-53ca-bb5d-079abb067d9b
status: experimental
author: Vorant

Source reporting: https://www.cisa.gov/news-events/alerts/2026/05/28/supply-chain-compromises-impact-nx-console-and-github-repositories

Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.