Trusted Dev Tools Abused to Steal Code and Secrets

Attackers are increasingly weaponizing trusted developer tools to infiltrate software supply chains, with CISA warning of multiple ongoing campaigns targeting CI/CD ecosystems and developer workflows.

Recent incidents, including a compromised Visual Studio Code extension and a large-scale operation dubbed “Megalodon,” highlight how adversaries are exploiting the very tools designed to accelerate modern software development.

One of the most critical incidents involves the Nx Console Visual Studio Code extension, where threat actors leveraged a prior compromise of Nx developer infrastructure to distribute a poisoned update.

The malicious version, identified as 18.95.0, was automatically delivered through VS Code’s update mechanism, meaning developers received the backdoored extension without any manual action.

This intrusion chain ultimately led to the compromise of a GitHub employee’s device, allowing attackers to gain unauthorized access to internal repositories and exfiltrate sensitive source code.

The vulnerability has been assigned CVE-2026-48027 and is now listed in CISA’s Known Exploited Vulnerabilities catalog, signaling active exploitation in the wild.

Security researchers at CISA, note that the attack demonstrates a growing trend where adversaries target developer tooling ecosystems rather than end-user systems.

By inserting malicious code into trusted extensions, attackers can bypass traditional security controls and operate within legitimate development environments.

GitHub has since issued a security advisory detailing the incident, while Nx published a postmortem confirming the supply chain compromise and outlining remediation efforts.

Trusted Dev Tools Abused

In parallel, another campaign known as “Megalodon” is actively targeting GitHub repositories by injecting malicious workflows into CI/CD pipelines.

Unlike the Nx incident, which relied on a compromised extension, Megalodon abuses GitHub Actions to harvest secrets directly from automated build and deployment processes.

Threat actors insert unauthorized workflow files or modify existing ones to extract sensitive data such as API keys, cloud credentials, and authentication tokens.

These include credentials tied to major cloud providers like AWS, Google Cloud, and Microsoft Azure, as well as tokens for platforms such as Docker, Kubernetes, and Terraform.

Because CI/CD pipelines often have elevated privileges and access to production environments, a single compromised workflow can expose an organization’s entire infrastructure.

Researchers from multiple security firms, including Ox Security and SafeDep, report that the campaign has impacted numerous public repositories, with automated bot accounts frequently used to disguise malicious commits.

CISA is actively prioritizing response efforts and has issued guidance for organizations to detect and contain potential compromises.

Security teams are advised to closely monitor repository activity, particularly suspicious pull requests or commits originating from automated accounts such as build or pipeline bots.

Organizations that suspect compromise should conduct a full forensic review of CI/CD logs, developer endpoints, and cloud audit trails.

Immediate rotation and revocation of all secrets is critical, including API keys, SSH credentials, and pipeline tokens. This step is essential to prevent continued unauthorized access after initial intrusion.

To reduce exposure to similar attacks, CISA recommends delaying the adoption of newly released packages to allow time for community vetting, pinning dependencies to trusted versions, and restricting downloads to verified sources. These practices help mitigate risks associated with malicious updates and dependency hijacking.

The convergence of these campaigns underscores a broader shift in attacker strategy toward software supply chain exploitation.

By targeting developer tools and automation pipelines, threat actors are gaining scalable access to high-value environments, making proactive monitoring and strict dependency controls essential for modern software security.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.