Poisoned Nx Console extension breaches GitHub repos
Supply chain attacks via malicious Nx Console VS Code extension compromised GitHub employee systems and Megalodon campaign injected malicious workflows to steal CI/CD secrets from public repositories.
CISA is responding to multiple software supply chain intrusion campaigns targeting developer ecosystems and CI/CD pipelines. Threat actors compromised Nx developer systems and used a poisoned Nx Console Visual Studio Code extension (version 18.95.0) to compromise a GitHub employee's device, resulting in unauthorized access and exfiltration of internal GitHub repositories. The malicious extension was distributed through VS Code's automatic update mechanism, potentially affecting all systems with Nx Console previously installed without requiring manual user action.
In a separate but related campaign dubbed Megalodon, threat actors injected malicious GitHub Action workflows into public repositories to harvest CI/CD secrets, cloud credentials, and tokens, impacting both development and deployment pipelines. This campaign demonstrates systematic abuse of CI/CD automation to compromise software supply chains at scale.
CISA recommends organizations audit workflow files and contributor activity for suspicious commits from automated accounts, particularly those made after May 18, 2026. Affected organizations should conduct forensic reviews of CI/CD logs and cloud audit trails, rotate all credentials and secrets accessible to CI/CD pipelines, and implement best practices including waiting three hours before pulling new packages and pinning software to specific trusted versions.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned from VS Code Extension Host
Detects shell/script interpreters or network utilities spawned by VS Code's main or extension host process, consistent with a malicious extension executing post-install payloads. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned from VS Code Extension Host
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \Code.exe
- \Code - Insiders.exe
Image|endswith:
- \powershell.exe
- \pwsh.exe
- \cmd.exe
- \wscript.exe
- \cscript.exe
- \curl.exe
- \certutil.exe
- \mshta.exe
filter:
CommandLine|contains:
- --version
- git rev-parse
- node_modules\.bin
condition: selection and not filter
falsepositives:
- Legitimate VS Code extensions that shell out to git, npm, or build tools during
normal development
- Integrated terminal usage inside VS Code launching interpreters directly
level: medium
tags:
- attack.t1554
- attack.t1195.002
id: eeef7038-afd0-5abb-91e1-80af10deb2f1
status: experimental
author: Vorant
Credential and Token Harvesting via Environment Dump Piped to Network Utility
Detects commands that enumerate environment variables (often containing CI/CD secrets, cloud tokens, or access tokens) and pipe or pass the output directly to a network transfer utility, indicating automated secret exfiltration from a compromised dev or CI/CD host. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Environment Variable Dump Piped to Network Utility
logsource:
category: process_creation
product: linux
detection:
selection_env:
CommandLine|contains:
- env
- printenv
- export -p
selection_net:
CommandLine|contains:
- curl
- wget
- 'nc '
selection_pipe:
CommandLine|contains: '|'
condition: selection_env and selection_net and selection_pipe
falsepositives:
- Legitimate CI/CD debugging scripts that intentionally log environment state to a
monitoring endpoint
- Configuration management tools that dump environment variables to internal logging
services
level: high
tags:
- attack.t1528
- attack.t1195.001
id: 31367486-9d07-56e8-8861-5c103ab7eac0
status: experimental
author: Vorant
New or Modified GitHub Actions Workflow File with Suspicious Remote Execution Pattern
Detects creation or modification of GitHub Actions workflow YAML files that contain patterns for downloading and executing remote scripts or decoding base64 payloads, consistent with malicious workflow injection used to harvest CI/CD secrets. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious GitHub Actions Workflow File Modification
logsource:
category: file_event
product: linux
detection:
selection_path:
TargetFilename|contains: /.github/workflows/
TargetFilename|endswith:
- .yml
- .yaml
selection_content_marker:
TargetFilename|contains:
- curl
- base64
- wget
condition: selection_path and selection_content_marker
falsepositives:
- Legitimate workflows that download build artifacts or dependencies from trusted
package registries
- CI pipelines that use base64 encoding for legitimate binary artifact transport
level: medium
tags:
- attack.t1195.001
- attack.t1195.002
- attack.t1213.003
id: 9b38b079-8f26-53ca-bb5d-079abb067d9b
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/alerts/2026/05/28/supply-chain-compromises-impact-nx-console-and-github-repositories
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free