// GitHubHIGH
CISA warned of two recent supply-chain compromises targeting GitHub. The Megalodon attack on May 18 involved malicious GitHub Action workflows injected into over 5,500 open-source repositories with weak branch protection, stealing cloud credentials, API tokens, SSH keys, and other secrets. A second attack involved compromise of a GitHub employee's device through a poisoned Nx Console Visual Studio Code extension (CVE-2026-48027) published May 19.
- CISA urges security teams to check for software development comp(opens in a new tab)
- Four Credential-Harvesting Campaigns Hit Open Source Ecosystems (opens in a new tab)
// Get alerts for GitHub