Critical VS Code Bug Lets Attackers Steal Source Code and Secrets
Key Takeaways A critical supply chain attack impacted millions of developers via a poisoned VS Code extension and malicious GitHub commits. The compromised Nx Console VS Code extension (v18.95.0) led...
Key Takeaways
- A critical supply chain attack impacted millions of developers via a poisoned VS Code extension and malicious GitHub commits.
- The compromised Nx Console VS Code extension (v18.95.0) led to the exfiltration of sensitive data, including GitHub source code, from affected machines.
- A second, parallel campaign dubbed “Megalodon” injected malicious GitHub Actions workflows into thousands of public repositories to steal CI/CD secrets and cloud credentials.
- CISA has issued an alert, assigned CVE-2026-48027, and added the vulnerability to its Known Exploited Vulnerabilities catalog.
- Organizations that used the compromised extension or have suspicious workflow changes must assume full compromise and take immediate remediation steps.
The cybersecurity landscape for software developers has been significantly disrupted by sophisticated supply chain attacks leveraging widely-used development tools. Threat actors have successfully exploited these trusted environments to steal sensitive source code, cloud tokens, and various credentials, putting millions of developers at risk.
Table Of Content
What makes these campaigns particularly concerning is their ability to compromise the very systems developers rely on most: their integrated development environments (IDEs), automated continuous integration/continuous deployment (CI/CD) pipelines, and version control workflows. In some instances, malware was deployed to developer machines without requiring any direct action from the user, highlighting the insidious nature of these attacks. Further details can be found in a comprehensive report on the abuse of trusted developer tooling.
Two Interconnected Campaigns Unveiled
This multi-pronged attack unfolded through two distinct yet interconnected campaigns.
VS Code Extension Compromise (CVE-2026-48027)
The first campaign involved the compromise of the popular Nx Console VS Code extension. On May 18, 2026, a malicious version, 18.95.0, was published to the Visual Studio Code Marketplace. With over 2.2 million installations, the potential impact of this poisoned extension was vast. Notably, a GitHub employee’s device was among those compromised, resulting in the unauthorized access and exfiltration of approximately 3,800 internal GitHub source code repositories. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) identified the full scope of this threat, issuing an urgent alert on May 28, 2026. CISA emphasized that threat actors were systematically targeting CI/CD pipelines, code extensions, and cloud environments. The malicious extension was assigned CVE-2026-48027 and added to CISA’s Known Exploited Vulnerabilities catalog. CISA, in a report shared with Cyber Security News (CSN), advised that any machine running the compromised extension should be considered fully compromised.
Megalodon’s Mass Repository Backdooring
Running concurrently, the second campaign, dubbed “Megalodon,” saw an automated attacker push an astonishing 5,718 malicious commits to 5,561 public GitHub repositories within a mere six-hour window on May 18, 2026. These injected GitHub Actions workflows were designed to harvest CI/CD secrets, cloud credentials, SSH keys, and OIDC tokens, transmitting all stolen data to a command-and-control server. Both campaigns underscore the increasing appeal of modern software delivery pipelines as high-value targets for threat actors seeking sensitive credentials.
Attackers Abuse Trusted Developer Tooling
The initial breach that enabled the VS Code extension compromise involved the theft of a contributor’s GitHub personal access token through a prior supply chain incident. This stolen token was then used to embed a hidden, obfuscated 498 KB JavaScript payload within an orphan commit in the official nrwl/nx GitHub repository. Subsequently, using stolen publishing credentials, the attackers published the malicious extension to the VS Code Marketplace, injecting 2,777 bytes of code into its primary file.
Once a developer opened a workspace with the compromised extension installed, the hidden payload was silently fetched and executed in the background. This payload deployed six distinct credential harvesting modules, targeting GitHub tokens, AWS credentials, HashiCorp Vault secrets, Kubernetes configurations, npm tokens, and 1Password vaults. Furthermore, it installed a Python backdoor on macOS systems. This backdoor utilized the GitHub Search API as a covert dead-drop mechanism to receive signed remote commands, making it exceptionally difficult to detect with conventional firewall monitoring.
Megalodon’s Mass Repository Backdooring
The Megalodon campaign adopted a different, yet equally destructive, strategy. Threat actors employed disposable GitHub accounts with fabricated author identities, such as build-bot and auto-ci, to push malicious workflow files. These files were disguised as routine CI maintenance commits, using deceptive workflow names like SysDiag and Optimize-Build to blend in with legitimate automation tasks, thereby evading casual review by developers.
The campaign utilized two payload variants. The “mass” variant introduced a new workflow that would trigger on every push and pull request. In contrast, the “targeted” variant replaced existing workflows with backdoors that attackers could activate on demand via the GitHub API. Notably, the npm package @tiledesk/tiledesk-server versions 2.18.6 through 2.18.12 contained the targeted variant, having been published by the legitimate maintainer from an already compromised repository without their knowledge.
What You Should Do
- Audit GitHub Repositories: Immediately audit all workflow files for suspicious commits made after May 18, 2026, especially those authored by automated accounts like
build-bot,auto-ci,ci-bot, orpipeline-bot. - Forensic Review: Conduct a comprehensive forensic review of CI/CD logs and cloud audit trails if your organization ran the compromised Nx Console extension or if unauthorized workflow changes are detected.
- Rotate All Credentials: Assume full compromise and rotate all credentials accessible to your pipelines. This includes API keys, cloud provider tokens (AWS, GCP, Azure), SSH keys, Docker and Kubernetes tokens, and all developer secrets.
- Update Nx Console: Ensure all instances of the Nx Console VS Code extension are updated to a safe version (e.g., v18.100.0 or later), or remove it if not actively used.
- Implement Supply Chain Best Practices: Wait at least three hours before pulling new packages, pin dependencies to trusted versions, and strictly source packages from verified repositories.
- Monitor for IoCs: Actively monitor your environment for the provided Indicators of Compromise (IoCs), including file hashes, Git SHAs, C2 IP addresses (216[.]126[.]225[.]129:8443), and specific file paths for the Python backdoor (e.g.,
~/.local/share/kitty/cat.pyon macOS/Linux).
No Comment! Be the first one.