Log in Request a demo

Significant cyber incident

Nx Console extension and GitHub repositories breach

On 18 May 2026 an attacker published a malicious version 18.95.0 of the Nx Console extension for VS Code, using a real Nx contributor's identity.

In short

On 18 May 2026 an attacker published a malicious version 18.95.0 of the Nx Console extension for VS Code, using a real Nx contributor's identity. Nx says the contributor's GitHub token was stolen a week earlier through the TanStack npm compromise. GitHub says one employee device was compromised through the poisoned extension and that GitHub-internal repositories were taken.

Last updated 9 October 2026

What happened

On 18 May 2026, between 12:30 and 13:09 UTC, a malicious Nx Console version 18.95.0 was live on the Visual Studio Marketplace and the Open VSX registry. Nx says the attacker published it as a legitimate Nx core contributor, using a GitHub CLI token stolen seven days earlier.

GitHub says that on the same Monday it detected and contained a compromise of an employee device involving a poisoned VS Code extension from a third party. It says the activity involved exfiltration of GitHub-internal repositories only, and that the attacker’s claim of about 3,800 repositories is directionally consistent with its findings so far.

On 28 May 2026 CISA published an alert covering the Nx Console and GitHub incident together with a second campaign, “Megalodon”, in which malicious GitHub Actions workflows were injected to harvest CI/CD secrets in public repositories.

Timeline

  1. 2026-05-11

    An attacker publishes 84 malicious versions across 42 @tanstack npm packages (TanStack compromise, as described by Nx).

  2. 2026-05-11

    At 20:43 UTC a Nx contributor's machine installs a malicious TanStack package. The malware steals the contributor's GitHub CLI token.

  3. 2026-05-11

    At 20:43:51 UTC the attacker pushes the first malicious commit using the stolen credentials.

  4. 2026-05-16

    Last observed use of the stolen token in Nx audit logs, about 5 days and 4 hours after the first use, according to Nx.

  5. 2026-05-18

    At 12:30 UTC the malicious Nx Console 18.95.0 is uploaded to the Visual Studio Marketplace. Open VSX lists it at 12:33 UTC.

  6. 2026-05-18

    At 12:36 UTC a maintainer gets the routine upload email and unpublishes the Marketplace version at 12:47 UTC.

  7. 2026-05-18

    At 13:09 UTC Open VSX unpublishes the version, about 36 minutes after publish.

  8. 2026-05-18

    GitHub says it detected and contained a compromised employee device. It begins rotating critical secrets that day and into Tuesday.

  9. 2026-05-18

    At 17:01 UTC Nx publishes advisory GHSA-c9j4-9m59-847w.

  10. 2026-05-20

    GitHub publishes its first post on the investigation. Nx advisory updated with a scope-of-impact change.

  11. 2026-05-21

    Nx publishes its postmortem and updates the advisory to name the TanStack compromise and GitHub CLI as the attack vector.

  12. 2026-05-26

    GitHub updates its post: it is rotating keys including the GitHub Enterprise Server signing key, and the investigation is still ongoing.

  13. 2026-05-27

    CVE-2026-48027 is published and CISA adds it to the KEV catalog.

  14. 2026-05-28

    CISA publishes its alert on Nx Console, GitHub repositories and the Megalodon campaign.

  15. 2026-05-29

    The Canadian Centre for Cyber Security publishes alert AL26-013.

How the attack worked

Step 1: a stolen token upstream

Nx says the chain began with the TanStack npm compromise of 11 May 2026. A Nx contributor ran a routine install in a project outside the Nx organization. That project asked for a 7-day delay on new packages, but its pinned pnpm version silently ignored the setting. The install pulled a TanStack package that was only 77 minutes old and ran a credential harvester.

Step 2: a publish with a real identity

The stolen GitHub CLI token let the attacker work inside Nx repositories for seven days without detection. Before this incident, any core contributor could publish an Nx Console release without a second person approving it. On 18 May the attacker uploaded version 18.95.0 to two extension registries as that contributor.

Step 3: the extension payload

Nx says the payload ran when the extension activated in VS Code or a fork such as Cursor. It left a Python backdoor and a macOS launch agent, tried to change the sudoers file on Linux, and looked for tokens and keys for Vault, npm, AWS, GitHub, 1Password, SSH, GCP and Docker. Data left by HTTPS, the GitHub API and DNS-based channels. CISA says the version spread through VS Code’s automatic update, so no manual install was needed.

Step 4: GitHub internal repositories

CISA and GitHub both say a GitHub employee device was compromised through the poisoned extension, followed by exfiltration of internal repositories. The public sources do not describe the steps between the device and the repositories.

Megalodon

CISA describes Megalodon as a separate campaign in which a threat actor injected malicious GitHub Actions workflows into public repositories to harvest CI/CD secrets, cloud credentials and tokens. The pages read do not give details of how it worked or whether it is linked to the Nx Console incident.

No source read for this page assigns MITRE ATT&CK technique ids to this incident.

Who says who was behind it

No public attribution. None of the pages read (Nx, GitHub, CISA, Canadian Centre for Cyber Security, NVD, KEV) names an actor for the Nx Console compromise or the GitHub intrusion. CISA refers to "threat actors" and, for Megalodon, "a cyber threat actor". GitHub refers to "the attacker" and "the threat actor". Whether Nx Console, the TanStack compromise and Megalodon are one actor is not stated in these sources.

Impact

Nx Console: Nx says Visual Studio Marketplace reported 28 installs of v18.95.0 and Open VSX reported 41 downloads from 21 unique IPs. Nx's own telemetry counted about 6,000 activations (activations, not installs), and Nx says real impact may be significantly higher. Nx also reports one activation from a Cursor editor.

GitHub: GitHub says the activity involved exfiltration of GitHub-internal repositories only. The attacker's claim of about 3,800 repositories is, in GitHub's words, directionally consistent with its investigation so far. The Canadian Centre for Cyber Security states that approximately 3,800 internal repositories were exfiltrated, containing proprietary source code and internal configuration data. Sources differ in framing: GitHub treats 3,800 as the attacker's claim, the Cyber Centre states it as fact.

GitHub says it had no evidence of impact to customer information stored outside its internal repositories, such as customers' own enterprises, organizations and repositories. It also says some internal repositories contain customer information, such as excerpts of support interactions, and that it would notify customers if impact is found.

Follow-on: GitHub rotated its Enterprise Server signing key and Enterprise Server admins had to rotate GPG public keys. GitHub Enterprise Cloud needed no action.

Megalodon: CISA says it affected public GitHub repositories. No counts are given in the pages read.

Government and regulator response

  • 18 May 2026, Nx: a maintainer unpublished the Marketplace version within about 11 minutes of the upload email and the Open VSX version at 13:09 UTC. Nx revoked the compromised engineer’s access, published advisory GHSA-c9j4-9m59-847w and later added a two-admin approval rule for publishing.
  • 18 to 20 May 2026, GitHub: removed the malicious extension version, isolated the endpoint and rotated critical secrets, highest impact first. First public post on 20 May 2026.
  • 26 May 2026, GitHub: rotated further keys including the Enterprise Server signing key, told Enterprise Server admins to rotate GPG public keys, and said the investigation was ongoing.
  • 27 May 2026: CVE-2026-48027 published. CISA added it to the KEV catalog with a due date of 10 June 2026. The Canadian Centre for Cyber Security issued bulletin AV26-512.
  • 28 May 2026, CISA: alert advising to audit workflow files and bot-account commits after 18 May 2026, rotate all secrets reachable by CI/CD, wait at least three hours before pulling new packages and pin versions.
  • 29 May 2026, Canadian Centre for Cyber Security: alert AL26-013 advising removal of v18.95.0, credential rotation for machines exposed between 11 and 20 May 2026, and disabling IDE extension auto-updates in high-security environments.

Lessons

  1. Publishing needs a second person

    Nx says any core contributor could publish Nx Console without another person's approval. It had hardened other pipelines but missed this one. A required reviewer on every release path breaks this kind of chain.

  2. Developer tokens are high-value

    Nx says the GitHub CLI token was readable by any local process. The attacker used it within 74 seconds and kept access for a week. Keep such tokens out of files and short-lived.

  3. Install delay settings must be verified

    The contributor's project asked for a 7-day wait on new packages, but an older pnpm version ignored it. A setting is only a control if the tool actually enforces it.

  4. Auto-update can spread a bad release

    CISA and the Cyber Centre both note the extension reached machines through automatic updates. The Cyber Centre suggests disabling IDE extension auto-updates in high-security environments and using an approved allowlist.

  5. Detection was luck, not design

    Nx says it found the problem through a routine upload email and did not detect it through a system it built. It says audit log monitoring would have shown the earlier activity.

  6. One compromise feeds the next

    The Nx incident began with a stolen token from a different supply chain compromise a week before. Credentials from one incident can be used elsewhere.

What to check in your own organization

  1. Extension inventory

    List the IDE extensions installed on developer machines (VS Code, Cursor and other forks). Check whether Nx Console 18.95.0 was ever present between 12:30 and 13:09 UTC on 18 May 2026.

  2. Persistence files

    On any machine that had it, look for the files Nx lists, such as ~/.local/share/kitty/cat.py, the kitty-monitor launch agent and /var/tmp/.gh_update_state. Rotate every credential reachable from that machine.

  3. Auto-update policy

    Decide where IDE extension auto-update is allowed. The Cyber Centre suggests turning it off in high-security environments and keeping an approved allowlist.

  4. Release approval

    Check that every pipeline that publishes to a public registry needs approval from someone other than the person who triggered it.

  5. Package age delay

    If you use a minimum package age setting, confirm your package manager version actually enforces it, as Nx's case showed. CISA suggests waiting at least three hours and pinning versions.

  6. Workflow and bot activity

    Review workflow files and commits from automated accounts after 18 May 2026, as CISA asks. Look for deleted workflow runs in your GitHub audit log.

  7. Early warning

    Threat intelligence monitoring can watch for your organization's credentials and tokens appearing in leaks, for alerts on newly compromised packages and extensions (here the TanStack packages a week before the Nx Console release), and for named campaigns. In this case Nx says the attacker was active for seven days before the publish. Early signals might have prompted a token rotation. This is not a promise of prevention.

Questions

What was the Nx Console incident?

On 18 May 2026 a malicious version 18.95.0 of the Nx Console VS Code extension was published to two extension registries for under an hour. It stole credentials from machines that ran it. CVE-2026-48027 covers that version.

Were 3,800 GitHub repositories stolen?

GitHub describes about 3,800 repositories as the attacker's claim and says it is directionally consistent with its investigation so far. The Canadian Centre for Cyber Security states approximately 3,800 internal repositories were exfiltrated.

Were GitHub customer repositories affected?

GitHub said it had no evidence of impact to customer information stored outside its internal repositories. It noted that some internal repositories hold customer information such as excerpts of support interactions.

When was it detected?

Sources give different dates because they describe different events. Nx and GitHub both say 18 May 2026 for detection. GitHub's first post is dated 20 May 2026 and its update 26 May 2026. The Cyber Centre says GitHub detected the access on 18 May 2026. The NVD description says the malicious version was published on 19 May 2026, which differs from Nx.

What is Megalodon?

CISA describes it as a campaign in which a threat actor injected malicious GitHub Actions workflows into public repositories to harvest CI/CD secrets, cloud credentials and tokens. The sources read give no further detail.

What should I do if I had version 18.95.0?

Nx and the Cyber Centre say to update (Nx: 18.100.0 or later), remove the persistence files, and rotate all credentials reachable from the machine.

In our research

  1. Nx Console and GitHub: dev tools as an entry path October 2026
  2. The Rise of Supply Chain Cyber Attacks: How Vendor Trust Becomes the Way In July 2026
  3. Supply chain attack Glossary term

Sources

  1. Postmortem: Nx Console v18.95.0 supply-chain compromise Nx (nx.dev)
  2. Compromised Nx Console version 18.95.0 (GHSA-c9j4-9m59-847w) nrwl/nx-console on GitHub
  3. Investigation update: GitHub Enterprise Server signing key rotation (includes the original 20 May 2026 post) GitHub
  4. Supply Chain Compromises Impact Nx Console and GitHub Repositories CISA
  5. AL26-013 Security incident impacting GitHub internal repositories Canadian Centre for Cyber Security
  6. CVE-2026-48027 record NIST National Vulnerability Database
  7. Known Exploited Vulnerabilities Catalog (JSON feed) CISA

Browse the threat library

Keep exploring

Knowledge Hub

Glossary term

Supply chain attack

A supply chain attack reaches its target by exploiting weaknesses in the products or services the target depends on.

Read more