Compromised Nx Console VS Code Extension Stole Developer and Cloud Secrets

A malicious 18.95.0 release of the Nx Console VS Code extension was briefly published to the Visual Studio Marketplace after attackers used stolen GitHub and marketplace publishing credentials to push a tampered build outside the normal release pipeline. The extension fetched an obfuscated payload from an orphaned commit in the official nrwl/nx GitHub repository and executed it when a workspace was opened, turning the trusted developer tool into a credential stealer. Researchers and vendor advisories said the malware harvested secrets from GitHub, npm, AWS, HashiCorp Vault, Kubernetes, 1Password, local files, and Claude Code-related configuration, then exfiltrated data over HTTPS, the GitHub API, and DNS while using anti-analysis checks and avoiding some CIS-region systems.

The intrusion was tracked as CVE-2026-48027 and was described as a supply-chain attack aimed at developer workstations rather than production servers directly, with the likely objective of pivoting into repositories, CI/CD pipelines, package registries, and cloud infrastructure through stolen trust material. Reports said the payload also attempted persistence on macOS and Linux and included Sigstore, Fulcio, and SLSA-related logic that could help attackers publish packages with apparently valid signed provenance using stolen OIDC tokens. Nx removed the malicious release, revoked exposed credentials, added stricter release approvals, and told users who installed 18.95.0 and opened a workspace during the exposure window to upgrade to 18.100.0 or later, remove persistence artifacts, terminate malicious processes, rotate all reachable credentials, and audit repositories, workflows, and service-account activity for abuse.