GitHub Internal Repositories Breached via Malicious Nx Console VS Code Extension
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-45321 | Supply chain compromise: credential-stealing code in 42 @tanstack/* npm packages | 9.6 | 3% | KEVRansomwarePoC ×2 | KEV |
| CVE-2026-48027 | Malicious Code Embedded in Nx Console VS Code Extension 18.95.0 | 9.3 | 2% | KEVRansomwarePoC | KEV |
From the original article
3 min read at thehackernews.com
Ravie Lakshmanan May 21, 2026 Supply Chain Attack / Developer Tools GitHub on Wednesday officially confirmed that the breach of its internal repositories was the result of a compromise of an employee device involving a poisoned version of the Nx Console Microsoft Visual Studio Code (VS Code) extension. The development comes as the Nx team revealed that the extension, nrwl.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.