Read more

https://cdn.mos.cms.futurecdn.net/x4SmwpYXk8yGgDmYCVeckL-2560-80.jpg

CISA warns that Nx Console and GitHub repositories abused in multiple supply chain compromises – tools across enterprise, cloud, and DevOps environments exploited

* CISA issued an alert on ongoing supply chain attacks abusing GitHub repos via a malicious Nx Console VSCode extension and the Megalodon campaign * Threat actors stole CI/CD secrets, cloud credentials, and tokens by poisoning workflows, prompting CISA to urge audits of contributor activity and workflow files * Recommended mitigations include