security1 distinct publisher
A poisoned Nx Console build rode VS Code's auto-update into GitHub's own repositories
CISA says a trojanized extension version, 18.95.0, reached a GitHub employee's machine without anyone installing it, and internal repositories left from there. CVE-2026-48027 is now in the KEV catalog.
Publishers:cisa.gov
Reality
- Evidence76
- Adoption58
- Hype gap−8
- Incentives24