Sunday, May 24, 2026 · 2 of 5

1. GitHub confirms ~3,800 internal repos exfiltrated via trojanized Nx Console VS Code extension — CVE-2026-48027

   (Disclosed May 19) — TeamPCP (Google: UNC6780) pushed a malicious build of the 2.2M-install extension that was live in the VS Code Marketplace for ~11 minutes; payload harvested Claude Code / 1Password / npm / AWS / GitHub creds. Grafana and OpenAI also hit.