cyber.hendryadrian.com
Security News · thehackernews.com

Compromised Nx Console 18.95.0 Used to Steal Developer Secrets

· Original article ↗

Summary

Researchers report that VS Code extension rwl.angular-console 18.95.0 ran a credential-stealing payload; Nx says a few users were compromised. The maintainers urge upgrading to 18.100.0 or later and rotating exposed credentials.

Key points

  • The affected rwl.angular-console 18.95.0 extension was published on the VS Code Marketplace; the Open VSX version was not affected.
  • A researcher said opening a workspace triggered the extension to fetch and execute a 498 KB obfuscated payload from an orphaned commit in the nrwl/nx GitHub repository.
  • The payload harvested secrets associated with 1Password, Anthropic Claude Code, npm, GitHub, and AWS, and reportedly exfiltrated them through HTTPS, the GitHub API, and DNS tunneling.
  • On macOS, the malware also installed a Python backdoor that used the GitHub Search API to receive further commands.
  • The extension maintainers traced the compromise to a developer whose machine was compromised and GitHub credentials leaked; Nx acknowledged that a few users were compromised.
  • The maintainers advised upgrading to version 18.100.0 or later, removing infected artifacts, terminating malicious processes, and rotating exposed credentials.
  • Researchers said the payload’s Sigstore, Fulcio, and SLSA capabilities could help malicious packages appear to have legitimate signed provenance.

Article Details

Event Type
Supply-chain compromise involving a malicious version of the Nx Console VS Code extension that delivered credential-stealing malware.
Impact
The payload harvested developer secrets, including 1Password vault data and credentials or tokens associated with Anthropic Claude Code, npm, GitHub, and AWS. It also installed a Python backdoor on macOS. The Nx team acknowledged that a few users were compromised; stolen npm OIDC tokens could enable malicious downstream packages to appear as verified builds, though the article does not report that such packages were published.

MITRE ATT&CK

T1041 · Exfiltration Over C2 ChannelThe payload exfiltrated stolen secrets via HTTPS, the GitHub API, and DNS tunneling.T1059.006 · PythonThe malware installed a Python backdoor on macOS.T1059.007 · JavaScriptThe attack installed the Bun JavaScript runtime to execute an obfuscated index.js payload.T1071.004 · DNSThe article specifically reports DNS tunneling as a channel used to exfiltrate stolen secrets.T1105 · Ingress Tool TransferThe extension fetched an obfuscated payload from a hidden commit in the nrwl/nx GitHub repository.T1195.002 · Compromise Software Supply ChainThe article describes a compromised VS Code extension and a malicious commit pushed to the nrwl/nx repository using leaked developer credentials.T1555 · Credentials from Password StoresThe malware harvested secrets from 1Password vaults and Anthropic Claude Code configurations.

People

Ashish KurmiA StepSecurity researcher who described the compromised extension fetching and executing an obfuscated payload from a hidden commit in the nrwl/nx GitHub repository.

Vendors

1PasswordThe malware stole secrets from 1Password, Anthropic Claude Code, npm, GitHub, and AWS.Amazon Web Servicesvaults and Anthropic Claude Code configurations, and secrets associated with npm, GitHub, and Amazon Web Services (AWS).AnthropicThe malware stole secrets from 1Password, Anthropic Claude Code, npm, GitHub, and AWS.GitHubThe attack was traced to leaked GitHub credentials from a developer account and affected the Nx ecosystem, prompting users to update immediately and rotate exposed credentials.MicrosoftResearchers uncovered a compromised Nx Console extension, rwl.angular-console 18.95.0, on the Microsoft Visual Studio Code Marketplace that silently executed an obfuscated payload to steal developer secrets and enable

Products

BunThe malicious action is triggered as soon as a developer opens any workspace in VS Code, leading to the installation of the Bun JavaScript runtime to run an obfuscated “index.js” payload.Claude CodeThe malware stole secrets from 1Password, Anthropic Claude Code, npm, GitHub, and AWS.npmThe malware stole secrets from 1Password, Anthropic Claude Code, npm, GitHub, and AWS.Nx ConsoleResearchers uncovered a compromised Nx Console extension, rwl.angular-console 18.95.0, on the Microsoft Visual Studio Code Marketplace that silently executed an obfuscated payload to steal developer secrets and enableVSCodeuncovered a compromised Nx Console extension, rwl.angular-console 18.95.0, on the Microsoft Visual Studio Code Marketplace that silently executed an obfuscated payload to steal developer secrets and enable

Related Articles