Executive Summary
In May 2026, two significant supply chain attacks targeted the developer ecosystem. The first involved a compromised version of the Nx Console Visual Studio Code extension (v18.95.0), which was live for approximately 18 minutes on May 18, 2026. This malicious extension exfiltrated credentials from developer machines, leading to unauthorized access and exfiltration of approximately 3,800 internal GitHub repositories. The second attack, dubbed 'Megalodon,' occurred on the same day and compromised over 5,500 GitHub repositories by injecting malicious GitHub Actions workflows designed to harvest CI/CD secrets and cloud credentials. These incidents underscore the escalating threat landscape targeting software development pipelines and the critical need for robust security measures in CI/CD environments. The rapid execution and widespread impact of these attacks highlight the urgency for organizations to implement stringent supply chain security practices and continuous monitoring to detect and mitigate such threats promptly.
Why This Matters Now
The rapid execution and widespread impact of these attacks highlight the urgency for organizations to implement stringent supply chain security practices and continuous monitoring to detect and mitigate such threats promptly.
Attack Path Analysis
An attacker compromised a developer's machine by exploiting a malicious Visual Studio Code extension, leading to unauthorized access to internal GitHub repositories. The attacker escalated privileges by leveraging stolen OAuth tokens to gain higher access within the GitHub environment. They moved laterally by injecting malicious GitHub Action workflows into various repositories to harvest CI/CD secrets and cloud credentials. The attacker established command and control by maintaining persistent access through these compromised workflows. They exfiltrated sensitive data, including internal code and credentials, from the repositories. The impact included potential exposure of proprietary code and credentials, leading to security breaches and operational disruptions.
Kill Chain Progression
Initial Compromise
Description
An attacker compromised a developer's machine by exploiting a malicious Visual Studio Code extension, leading to unauthorized access to internal GitHub repositories.
Related CVEs
CVE-2026-48027
CVSS 9.8A malicious version of Nx Console (18.95.0) was published, allowing unauthorized access and exfiltration of internal GitHub repositories.
Affected Products:
Nx Nx Console – 18.95.0
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Supply Chain Compromise: Compromise Software Supply Chain
Valid Accounts
Unsecured Credentials: Credentials in Files
Credentials from Password Stores: Credentials from Web Browsers
Exfiltration Over Web Service: Exfiltration to Cloud Storage
Application Layer Protocol: Web Protocols
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Change Control Processes
Control ID: 6.4.1
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management Framework
Control ID: Article 5
CISA ZTMM 2.0 – Supply Chain Risk Management
Control ID: 3.1
NIS2 Directive – Security Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
Critical exposure through CI/CD pipeline compromises, malicious VS Code extensions, and GitHub repository infiltration affecting software development workflows and supply chains.
Information Technology/IT
High risk from compromised developer tools, automated CI/CD attacks, and cloud credential harvesting requiring immediate secret rotation and infrastructure security reviews.
Computer/Network Security
Direct impact on security organizations managing DevOps pipelines, with compromised GitHub repositories and malicious extensions bypassing traditional security controls and monitoring.
Financial Services
Severe regulatory compliance risks from potential data exfiltration through compromised development environments, requiring enhanced zero trust segmentation and traffic monitoring capabilities.
Sources
- Supply Chain Compromises Impact Nx Console and GitHub Repositorieshttps://www.cisa.gov/news-events/alerts/2026/05/28/supply-chain-compromises-impact-nx-console-and-github-repositoriesVerified
- Nx Console v18.95.0 Postmortemhttps://nx.dev/blog/nx-console-v18-95-0-postmortem#indicators-of-compromiseVerified
- Nx Console VS Code Extension Compromisedhttps://www.stepsecurity.io/blog/nx-console-vs-code-extension-compromisedVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it would likely limit the attacker's ability to move laterally and exfiltrate data by enforcing strict segmentation and controlled egress policies.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The attacker's ability to access internal GitHub repositories would likely be constrained, reducing unauthorized access to sensitive code.
Control: Zero Trust Segmentation
Mitigation: The attacker's ability to escalate privileges within the GitHub environment would likely be constrained, reducing unauthorized access to sensitive repositories.
Control: East-West Traffic Security
Mitigation: The attacker's ability to move laterally by injecting malicious workflows would likely be constrained, reducing unauthorized access to CI/CD secrets and cloud credentials.
Control: Multicloud Visibility & Control
Mitigation: The attacker's ability to maintain persistent access through compromised workflows would likely be constrained, reducing unauthorized control over internal systems.
Control: Egress Security & Policy Enforcement
Mitigation: The attacker's ability to exfiltrate sensitive data from repositories would likely be constrained, reducing unauthorized data leakage.
The potential exposure of proprietary code and credentials would likely be constrained, reducing the risk of security breaches and operational disruptions.
Impact at a Glance
Affected Business Functions
- Software Development
- Version Control
- Continuous Integration/Continuous Deployment (CI/CD)
Estimated downtime: 3 days
Estimated loss: $50,000
Unauthorized access and exfiltration of internal GitHub repositories, potentially exposing proprietary code and sensitive information.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to restrict access and limit lateral movement within the network.
- • Enhance Threat Detection & Anomaly Response capabilities to identify and respond to unauthorized activities promptly.
- • Enforce Egress Security & Policy Enforcement to monitor and control outbound traffic, preventing data exfiltration.
- • Utilize Multicloud Visibility & Control to gain comprehensive insights into cloud environments and detect suspicious behaviors.
- • Regularly audit and monitor CI/CD pipelines and associated workflows to identify and remediate potential security vulnerabilities.
