Compromised Nx Console VS Code Extension Steals Developer and Cloud Secrets

Nx Console’s popular VS Code extension was briefly weaponized into a credential-stealing tool that can leak developer and cloud secrets and plant a persistent backdoor. Anyone who installed v18.95.0 should treat their environment as fully compromised.

On May 18, 2026, a malicious build of the Nx Console VS Code extension, nrwl.angular-console v18.95.0 was published to the Visual Studio Code Marketplace, despite the extension having over 2.2 million installs.

The rogue version executed as soon as a developer opened any workspace, silently fetching and running a 498 KB obfuscated payload from a hidden dangling commit inside the official nrwl/nx GitHub repository.

The malicious build was live for roughly 11 minutes before the Nx team removed it, but that short window is enough for widespread compromise given auto-updates and frequent extension installs.

According to Stepsecurity, second major supply chain incident to hit the Nx ecosystem in under a year, following the August 2025 campaign that abused malicious Nx npm packages to steal credentials at scale.

In contrast to that npm‑focused wave, the new attack pivoted to the VS Code extension channel using a stolen contributor GitHub token as the initial foothold into the publishing pipeline.

The Nx team confirmed that the root cause was a supply chain attack that scraped a contributor’s GitHub personal access token, which then gave the attacker push access to the nrwl/nx repo and, directly or indirectly, to the VS Code Marketplace publishing credentials (VSCE_PAT).

Using that token, the threat actor pushed an orphan commit (no parents, unreachable from branches) to nrwl/nx, which replaced the repository tree with a minimal package.json and a huge index.js dropper designed to run under Bun.

The commit was falsely attributed to a former contributor and carried a social‑engineering commit message threatening a “wiper” to discourage rapid cleanup, even though the warning itself was bogus.

The attacker then locally built a tampered Nx Console extension and published v18.95.0 straight to the VS Code Marketplace with around 2.7 KB of malicious code injected into the minified main.js file.

The injected code hooked into the extension’s activate() entry point, checked a custom globalState key, and if the expected SHA was missing, launched a hidden VS Code task that ran npx -y github:nrwl/nx#<dangling_sha> in the background with no user prompt.

OpenVSX was not affected, so the blast radius is limited to users who pulled from the Microsoft marketplace.

Nx Console VS Code Extension

Once executed, the 498 KB obfuscated payload behaves as a multi‑stage credential stealer and supply chain poisoning toolkit.

It uses several anti‑analysis gates (CPU count, environment checks, geolocation filters, lock files) and then daemonizes itself so the malicious process continues running invisibly after the VS Code task exits cleanly.

The core collectors systematically hunt for and extract high‑value secrets from GitHub, npm, AWS, HashiCorp Vault, Kubernetes environments, and 1Password, and they also scan the filesystem and /proc memory for embedded credentials.

A particularly notable capability is full Sigstore integration, including Fulcio certificate issuance, Rekor transparency log interaction, and generation of SLSA and in‑toto provenance attestations tied to stolen npm OIDC tokens.

That means the actor can push downstream npm packages that appear to be legitimately built, cryptographically signed artifacts, effectively weaponizing trusted‑publishing and provenance checks against the ecosystem.

The payload also expressly targets Claude Code configuration files under ~/.claude/settings.json, making this one of the first supply chain payloads observed going after AI coding assistant credentials and settings as part of its collection scope.

Exfiltration is designed to be resilient: harvested secrets are encrypted and compressed, then sent over three separate channels direct HTTPS POST to an obfuscated C2 domain, abuse of the GitHub API using any discovered tokens, and DNS tunneling so any working path is enough for data theft to succeed.

On macOS, the JavaScript stage drops a Python backdoor under a kitty‑themed path and registers a LaunchAgent to call home hourly via the GitHub Search API, using signed commit messages as a dead‑drop C2 channel hardened with 4096‑bit RSA signatures.

Anyone who had nrwl.angular-console v18.95.0 installed should assume full compromise of developer credentials, cloud keys, and any secrets accessible from that machine or its CI context.

At minimum, organizations should remove the malicious extension, rotate all potentially exposed tokens and keys, audit npm publishing logs for suspicious signed releases, and hunt for the macOS LaunchAgent and dropped Python backdoor on developer endpoints.

Given Nx’s recent history of sophisticated supply chain attacks, teams using Nx, Nx Console, or related tooling should urgently tighten extension governance, enforce least‑privilege tokens, and continuously monitor for anomalous use of Sigstore, npm OIDC, and GitHub tokens across their pipelines.

Indicators of Compromise

Category	Indicator	Description
File Hashes (SHA-256)	1a4afce34918bdc74ae3f31edaffffaa0ee074d83618f53edfd88137927340b8	Malicious VSIX (v18.95.0)
File Hashes (SHA-256)	b0cefb66b953e5184b6adb3035e9e267335ac5eabfe1848e07834777b9397b74	Malicious main.js (in VSIX)
File Hashes (SHA-256)	e7347d90653efc565f03733a95e9209d78f9cfa81e31ff2b2dd9d48d75a4b8b1	Obfuscated payload (index.js from orphan commit)
File Hashes (SHA-256)	43f2b001846c4966073ebffa5be8f15e491a1e7d32bbd805d57406ff540e0dd9	Dropper package.json
File Hashes (SHA-256)	228a2cf081d4cbea9b91cde14a8f9c4a4d003e7f32431496953fd6bac266f5a3	Clean VSIX (v18.94.0)
File Hashes (SHA-256)	cb86f4f223daa54467c7782a0d8607e9c84e2bb633e6f0e51d9a19579e200990	Remediated VSIX (v18.100.0)
Network Indicators	api.github.com/search/commits?q=firedalazer	Python C2 dead-drop polling
Network Indicators	Encrypted C2 domain on port 443	HTTPS exfiltration (not statically recoverable)
Network Indicators	169.254.169.254	AWS IMDS credential theft
Network Indicators	169.254.170.2	ECS container credential endpoint
Network Indicators	127.0.0.1:8200	HashiCorp Vault local endpoint
Network Indicators	fulcio.sigstore.dev / rekor.sigstore.dev	Sigstore attestation forgery
Network Indicators	bun.sh/install	Runtime installation for persistence
Network Indicators	DNS tunneling queries	Backup exfiltration channel

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.