Critical Microsoft Entra ID Flaw Exposes Microsoft 365, Azure Data

Key Takeaways

• A critical supply chain attack compromised the Nx Console VS Code extension, impacting over 2.2 million users globally.
• Malicious version 18.95.0, active for only eleven minutes on May 18, 2026, stealthily deployed a sophisticated credential stealer and backdoors.
• The attack leveraged a stolen GitHub token and VS Code Marketplace credentials, deploying a hidden payload that targeted a wide array of sensitive developer secrets.
• The incident represents the second supply chain compromise against the Nx ecosystem within a year, highlighting persistent risks in open-source development tools.
• Immediate action is required for affected users, including updating the extension, removing persistence artifacts, and rotating all credentials.

On May 18, 2026, a significant supply chain attack unfolded, compromising a widely-used developer tool: the Nx Console extension for Visual Studio Code. This incident, detailed in a report by StepSecurity researchers, saw a malicious version of the extension deployed, capable of exfiltrating sensitive credentials and establishing persistent backdoors on developer machines.

The compromise of version 18.95.0 of the nrwl.angular-console extension marks the second such supply chain attack against the Nx ecosystem in less than a year. This recurrence raises serious questions about the security posture of open-source developer tools that are integral to millions of software development workflows worldwide.

The malicious extension, which boasts over 2.2 million installations globally, was pushed to the VS Code Marketplace with hidden code embedded within its main.js file. Upon a developer opening any workspace, the compromised extension rapidly fetched and executed a 498 KB obfuscated payload. This payload was cleverly concealed within an orphan commit in the official nrwl/nx GitHub repository, making it virtually undetectable through standard means.

StepSecurity’s comprehensive analysis, shared with Cyber Security News, revealed a complex, multi-stage infection chain. The payload was identified as a sophisticated credential stealer, designed to target a broad spectrum of sensitive information, including GitHub tokens, npm credentials, AWS secrets, HashiCorp Vault tokens, Kubernetes configurations, and even 1Password vault items accessible via the command line.

Despite its brief eleven-minute presence on the marketplace before being detected and removed by the Nx team at 12:47 UTC, the threat actor engineered the payload for maximum efficiency. It rapidly daemonized itself in the background, initiating multiple credential collection processes concurrently to harvest as many secrets as possible before intervention.

An alarming aspect of this attack is its potential to exploit Sigstore attestation logic. This capability could allow attackers to publish downstream npm packages with seemingly valid, cryptographically signed provenance, potentially spreading the compromise far beyond the initial developer machines affected during the short exposure window.

How the Extension Was Weaponized

The genesis of this attack involved the theft of a contributor’s GitHub personal access token during an earlier, unrelated supply chain incident. Leveraging this stolen token, the attacker pushed an orphan commit, identified as 558b09d7, to the nrwl/nx repository at 03:18 UTC. This commit was deliberately detached from any parent commits and inaccessible from any branch, effectively rendering it invisible to anyone without its precise SHA identifier.

This orphan commit replaced the entire Nx monorepo with just two files: a package.json and a heavily obfuscated index.js payload. Subsequently, at 12:36 UTC, the attacker utilized stolen VS Code Marketplace publishing credentials to release the poisoned extension. This extension was configured to silently fetch and execute the hidden payload the moment a developer opened any workspace, all without any visible indicators of malicious activity.

Credential Theft and Persistent Backdoor

Once executed, the payload initiated six specialized collector classes simultaneously, each designed to harvest a distinct category of secrets. For Linux systems, it also attempted to gain passwordless sudo access. If successful, it would inject a sudoers rule to establish persistent root-level access on the compromised host.

On macOS systems, the payload deployed a Python-based backdoor located at ~/.local/share/kitty/cat.py. This backdoor was registered as a LaunchAgent, configured to run automatically every hour. It employed the GitHub Search API as a covert command-and-control channel, polling for attacker-signed instructions every sixty minutes. This method is particularly insidious as it mimics normal developer traffic, making it less likely to be detected by corporate firewalls or endpoint detection tools.

Any user who had Nx Console installed with auto-update enabled and opened a workspace between 12:36 and 12:47 UTC on May 18 should consider their machine fully compromised. StepSecurity advises immediate action, including updating to version 18.100.0 or later, meticulously removing all persistence artifacts, terminating any orphaned background processes, and rotating every credential accessible from the affected machine. This includes GitHub tokens, npm tokens, SSH keys, AWS credentials, and any secrets that were in process memory during the compromise window.

Indicators of Compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

What You Should Do

• Immediately update the Nx Console VS Code extension to version 18.100.0 or later.
• Scan your system with reputable antivirus and anti-malware software to detect and remove any malicious files or processes.
• Manually check for and remove persistence artifacts, including the Python backdoor at ~/.local/share/kitty/cat.py and the macOS LaunchAgent ~/Library/LaunchAgents/com.user.kitty-monitor.plist.
• Terminate any suspicious background processes, particularly those with the __DAEMONIZED=1 environment variable set.
• Rotate all credentials that were accessible from the affected machine. This includes, but is not limited to, GitHub tokens, npm tokens, SSH keys, AWS credentials, and any secrets stored in process memory at the time of compromise.
• Enable multi-factor authentication (MFA) on all developer accounts and critical services.
• Implement stricter supply chain security practices, including verifying the integrity of all third-party dependencies and extensions.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.