Cybersecurity researchers have flagged a compromised version of the Nx Console extension that was published to the Microsoft Visual Studio Code (VS Code) Marketplace.
The extension in question is rwl.angular-console (version 18.95.0), a popular user interface and plugin for code editors like VS Code, Cursor, and JetBrains. The VS Code extension has more than 2.2 million installations.
“Within seconds of a developer opening any workspace, the compromised extension silently fetched and executed a 498 KB obfuscated payload from a dangling orphan commit hidden inside the official nrwl/nx GitHub repository,” StepSecurity researcher Ashish Kurmi said.
The payload is a “multi-stage credential stealer and supply chain poisoning tool” that harvests developer secrets and exfiltrates them via HTTPS, the GitHub API, and DNS tunneling. It also installs a Python backdoor on macOS systems that abuses the GitHub Search API as a dead drop resolver for receiving further commands.
In an advisory issued Monday, the maintainers of the extension said the root cause has been traced to one of its developers, whose machine was compromised in a recent security incident that leaked their GitHub credentials. Although the nature of the prior “incident” was not disclosed, the developer’s credentials have since been temporarily revoked.
The access afforded by the credentials is said to have been abused to push an orphaned, unsigned commit to nrwl/nx, which introduces the stealer malware. The malicious action is triggered as soon as a developer opens any workspace in VS Code, leading to the installation of the Bun JavaScript runtime to run an obfuscated “index.js” payload.
The malware runs checks to avoid infecting machines likely located in the Russian/CIS time zones and launches itself as a detached background process to kick off the credential harvesting workflow, allowing it to retrieve sensitive data from 1Password vaults and Anthropic Claude Code configurations, and secrets associated with npm, GitHub, and Amazon Web Services (AWS).
“One capability that stands out: the payload contains full Sigstore integration, including Fulcio certificate issuance and SLSA provenance generation,” StepSecurity said. “Combined with stolen npm OIDC tokens, this means the attacker could publish downstream npm packages with valid, cryptographically signed provenance attestations, making the malicious packages appear as legitimate, verified builds.”
The Nx team also acknowledged a “few users were compromised” as a result of this breach. Besides urging users to update to 18.100.0 or later, the maintainers have published the following indicators of compromise –
- Nx Console version 18.95.0 was installed during the exposure window between May 18, 2026, at 2:36 p.m. CEST and 2:47 p.m. CEST.
- Presence of files like ~/.local/share/kitty/cat.py, ~/Library/LaunchAgents/com.user.kitty-monitor.plist, /var/tmp/.gh_update_state, or /tmp/kitty-*.
- Presence of any of the following running processes: a python process running cat.py and a process with __DAEMONIZED=1 in its environment.
Affected users are recommended to terminate the aforementioned processes, delete artifacts on disk, and rotate all credentials reachable from the affected machine, including tokens, secrets, and SSH keys.
The development marks the second time the Nx ecosystem has been targeted within a year. In August 2025, several npm packages were infected by a credential stealer as part of a supply chain attack campaign named s1ngularity. Unlike the previous iteration, the latest attack targets the VS Code extension.
Malicious npm Packages Galore
The findings coincide with the discovery of various malicious packages in the open-source repositories –
- iceberg-javascript, supabase-javascript, auth-javascript, microsoft-applicationinsights-common, and ms-graph-types: Five npm packages containing a hidden ELF binary that backdoors Claude Code sessions to steal developer credentials.
- noon-contracts: an npm package that impersonates a Noon Protocol smart contract SDK to exfiltrate SSH keys, crypto wallet private keys, AWS credentials, Kubernetes secrets, all .env files, shell history, Docker/Git/npm tokens, and browser wallet storage paths.
- martinez-polygon-clipping-tony: a trojanized fork of martinez-polygon-clipping that uses a postinstall hook to download a 17MB PyInstaller-packed Windows remote access trojan (RAT) that uses Telegram for command-and-control (C2) for remote shell execution, screenshot capture, file upload/download, and arbitrary Python execution.
- common-tg-service: an npm package that contains functionality to take over a victim’s Telegram account while masquerading as “Common Telegram service for NestJS applications.”
- exiouss: an npm package that bundles a ChatGPT and OpenAI session cookie stealer targeting web browsers like Google Chrome, Microsoft Edge, and Brave.
- k8s-pod-checker, dev-env-setup, and node-perf-utils: three npm packages part of the kube-health-tools cluster that install a large language model (LLM) proxy service on the victim’s machine, allowing the attacker to route LLM traffic through the compromised server
- A coordinated credential harvesting campaign orchestrated by an Indonesian-speaking threat actor using a set of 38 npm packages that leverages dependency confusion as a way to trick CI/CD pipelines to resolve malicious public packages ahead of legitimate private ones associated with Apple, Google, and Alibaba, among others.
- An unusual campaign wherein seven npm packages under the @hd-team organization have been found to act as a stager for configurations used by a Chinese sports gambling and pirated streaming platform named Douqiu to determine the backend servers to connect to.
Update
On May 20, 2026, the Nx team disclosed that it’s working with Microsoft and GitHub to understand the impact following the publication of the malicious Nx Console version 18.95.0 by unknown threat actors.
“Initially, Microsoft indicated to us that there were 28 installs of the malicious version 18.95.0,” Jeff Cross, co-founder of Narwhal Technologies, the company behind nx.dev, said. “Based on our own analytics for the compromised version, we currently believe the number of users who received the malicious package may be significantly higher; potentially over 6,000 installs.”
All the installs originated from VS Code, according to an updated advisory. As many as 41 installs came from the Open VSX registry.
Nx Console Hack Stemmed from TanStack Supply Chain Attack
In a fresh update shared on May 21, 2026, the Nx team officially acknowledged that one of its developers was compromised by a recent supply chain compromise targeting TanStack, causing their GitHub credentials to be leaked. “This allowed the attacker to run workflows on our GitHub repository as a contributor,” the maintainers said.
In a post-mortem published on May 21, 2026, the Nx team warned that anyone who had Nx Console with auto-update enabled during the exposure window should assume compromise. The malicious version was published on May 18, 2026, between 12:30 and 1:09 p.m. UTC. The extension was live in the Visual Studio Marketplace package for about 11 minutes and nearly 36 minutes in Open VSX.
“The attacker published the malicious version as a legitimate Nx core contributor,” the maintainers said. “A credential-stealing payload that arrived through the TanStack supply-chain compromise had silently exfiltrated that contributor’s GitHub CLI OAuth token seven days earlier. Between credential theft on May 11 and the marketplace publish on May 18, the attacker was active in our GitHub repos for seven days without detection.”
Following the incident, the Nx team has rolled out a number of changes, including requiring approval to publish Nx Console, enhanced monitoring GitHub audit log for suspicious events, for example workflow-run deletions, and pinning GitHub Action SHAs instead of floating refs (e.g., @v6, @main) across all repositories.
