CISA Flags Exploited Supply-Chain Attacks in Nx Console, TanStack, and DAEMON Tools

CISA added three actively exploited software supply-chain vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2026-48027 in Nx Console, CVE-2026-45321 in TanStack npm packages, and CVE-2026-8398 in DAEMON Tools Lite. The Nx Console incident involved a malicious 18.95.0 extension published to Visual Studio Marketplace and OpenVSX after a prior compromise of Nx developer systems; CISA said the poisoned extension was automatically distributed and was used to compromise a GitHub employee device, leading to unauthorized access to and exfiltration of internal GitHub repositories. CISA identified Nx Console 18.100.0 as clean and said federal agencies must remediate the listed flaws under BOD 22-01 or discontinue use if mitigations are unavailable.

CISA also warned that the TanStack intrusion abused GitHub Actions through a pull_request_target misconfiguration, cache poisoning, and OIDC token theft to publish malicious packages, with reporting indicating 84 malicious versions across 42 packages carried valid Sigstore/SLSA provenance. In parallel, the agency highlighted the Megalodon campaign, in which attackers inserted malicious GitHub Actions workflows into public repositories to steal CI/CD secrets, cloud credentials, and tokens, and said organizations should audit workflow files and contributor activity, revert unauthorized automated-account changes, conduct forensic reviews, rotate potentially exposed secrets, delay package pulls, pin trusted versions, and use only trusted package sources. The DAEMON Tools Lite case involved trojanized signed installers reportedly distributed from the vendor’s website after a suspected compromise of build or distribution systems.