Critical Nx Console VS Code Extension Flaw Steals Developer Secrets

Key Takeaways

• A critical supply chain attack compromised the Nx Console Visual Studio Code extension (version 18.95.0) on May 18, 2026.
• The malicious version, active for approximately 11 minutes, deployed a sophisticated credential-stealing payload affecting millions of developers.
• The malware targeted a wide array of developer secrets, including those for GitHub, AWS, npm, HashiCorp Vault, Kubernetes, 1Password, and even AI coding assistants like Claude Code.
• The attack also established a persistent Python backdoor on macOS systems.
• Developers who installed or used version 18.95.0 during the compromise window must assume all credentials on affected machines are compromised and take immediate remediation steps.

A sophisticated supply chain attack briefly transformed the popular Nx Console Visual Studio Code extension into a credential-harvesting tool on May 18, 2026. This incident, which placed millions of developers at severe, undetected risk, involved the publication of a malicious version to the official VS Code Marketplace.

The compromised extension, boasting over 2.2 million installations, was exploited when attackers leveraged stolen publishing credentials to push a malicious update. This marks the second supply chain breach impacting the Nx ecosystem within a year, highlighting persistent vulnerabilities in developer toolchains.

Nx Console VS Code Extension Compromised

On May 18, 2026, at 12:36 UTC, version 18.95.0 of the Nx Console extension (nrwl.angular-console) was published to the marketplace. This malicious version contained a hidden, obfuscated payload of 498 KB, which was designed to execute silently the moment a developer opened any workspace. The payload was hosted within a dangling orphan commit on the official nrwl/nx GitHub repository, demonstrating a multi-stage attack methodology.

The malicious version remained live for only about 11 minutes before the Nx team identified and removed it. Analysts at StepSecurity swiftly detected and documented the attack, confirming its nature as a multi-stage supply chain compromise.

Attack Chain Details

The initial breach occurred well before the malicious extension release. Attackers obtained a contributor’s GitHub personal access token during a prior supply chain incident. This token provided the necessary access to the official repository. At 03:18 UTC, attackers pushed an orphan commit to the nrwl/nx repository. This commit, lacking any parent history or visible branch connection, effectively replaced the repository’s contents with just two files: a package.json and an obfuscated index.js payload.

The subsequent release of version 18.95.0 at 12:36 UTC injected a mere 2,777 bytes of malicious code into the minified main.js file. This compact code then activated the larger, obfuscated payload upon workspace opening. A particularly concerning aspect of this attack was the payload’s full Sigstore integration. Using stolen npm OIDC tokens, the attackers could have generated cryptographically signed provenance for downstream npm packages, making any malicious packages appear legitimate and verified.

Payload Behavior and Exfiltration

Once activated, the payload initiated six concurrent credential collectors, systematically targeting a broad spectrum of sensitive data on the developer’s machine. This included querying AWS metadata services, extracting HashiCorp Vault tokens, scanning npm configuration files, and directly reading process memory on Linux systems via /proc/*/mem.

The exfiltration mechanism was robust and redundant, designed to ensure data theft even if one channel was blocked. Collected data was encrypted using AES-256-GCM and further protected with an RSA public key before being transmitted via three distinct channels: HTTPS, the GitHub API, and DNS tunneling.

The malware incorporated anti-analysis techniques to evade detection in security research environments. It would skip execution on systems with fewer than four CPU cores and avoid machines located in Russian or CIS time zones. These measures aimed to ensure the malware operated exclusively within genuine developer setups, bypassing typical sandbox environments.

Uniquely, the payload also targeted configuration files for AI coding assistants like Claude Code, marking it as one of the first known supply chain attacks designed to steal credentials from such tools. On macOS, the malware established a persistent Python backdoor (~/.local/share/kitty/cat.py) that communicated with a command-and-control server hourly, signed with a 4096-bit RSA key.

Any developer who had version 18.95.0 installed and opened a workspace between 12:36 and 12:47 UTC on May 18 must assume their credentials are compromised.

What You Should Do

• Immediately update the Nx Console extension to version 18.100.0 or later.
• Remove any persistence artifacts, particularly the Python backdoor at ~/.local/share/kitty/cat.py and its corresponding LaunchAgent entry (~/Library/LaunchAgents/com.user.kitty-monitor.plist) on macOS.
• Rotate all sensitive credentials, including cloud tokens (AWS, GCP, Azure), GitHub Personal Access Tokens, npm tokens, SSH keys, and any secrets stored in .env files.
• Review system logs for suspicious outbound connections or unauthorized file modifications during the compromise window (May 18, 12:36-12:47 UTC).
• Implement enhanced monitoring for unusual activity originating from developer workstations.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.