Poisoned Pipeline

Poisoned Pipeline / Incidents / AS192

AS192 · 2026-05

Nx Console VS Code 18.95.0 (GitHub internal repo theft)

VS Code / IDEGit / GitHubDeveloper workstationGitHub Actions

CISA alert 28 May 2026: malicious Nx Console VS Code extension
18.95.0 auto-updated onto developer machines and was used to reach
a GitHub employee device, then GitHub-owned repositories. Distinct
from the Aug 2025 Nx npm s1ngularity incident (AS74). CVE-2026-48027
in KEV. GitHub and Nx post-mortems.

Mapped techniques

supply-chain poisoned ide extension

T0154 · Initial Access · Malicious IDE extension

Nx Console 18.95.0 via VS Code auto-update.

T0153 · Initial Access · Compromised developer workstation

GitHub employee device.

T0186 · Impact · Source code leak

Unauthorized access to GitHub-owned repositories.

Sources