Nx Console VS Code Extension Compromise Deployed Credential-Stealing Payload

Summary

Step Security details how malicious Nx Console v18.95.0 used a stolen contributor token and hidden orphan commit to run a payload targeting developer secrets and persistence. It recommends rotating all accessible credentials and rebuilding affected machines.

Key points

On May 18, 2026, an attacker used a stolen contributor token to plant an orphan commit in the Nx repository and publish malicious nrwl.angular-console v18.95.0 to the VS Code Marketplace; the extension was removed after about 11 minutes.
Opening a workspace silently triggered the extension to fetch and run a 498 KB obfuscated payload through Bun. The payload used anti-analysis checks and detached execution.
The payload targeted credentials and secrets from GitHub, npm, AWS, HashiCorp Vault, Kubernetes, 1Password, Claude Code configuration, and process memory. It attempted exfiltration over HTTPS, the GitHub API, and DNS tunneling.
The payload included logic to use stolen npm OIDC tokens with Sigstore and SLSA provenance, potentially making attacker-published packages appear to have legitimate signed provenance; the article does not report that such packages were actually published.
The payload wrote a Python backdoor and macOS LaunchAgent that polled the GitHub Search API for signed commands. Step Security reports that in at least three cases the backdoor failed to establish its C2 loop because the requests module was unavailable, although the JavaScript collector had run.
The article reports GitHub's disclosure that about 3,800 internal source-code repositories were exfiltrated after an employee device was compromised. It says GitHub did not officially name the extension, while Nx CEO Jeff Cross confirmed Nx was working with Microsoft and GitHub on the impact of v18.95.0; the article attributes the breach to TeamPCP and says the data was being offered for sale.
OpenVSX was not affected. The article recommends updating to Nx Console v18.100.0 or later, rotating credentials and secrets accessible from affected machines, auditing relevant accounts and services, and reimaging machines in high-sensitivity environments.

Article Details

Attack Vectors: A contributor's GitHub token, reportedly stolen in an earlier supply-chain incident, was used to plant an orphan commit in nrwl/nx and publish compromised Nx Console VS Code extension version 18.95.0 using stolen marketplace publishing credentials.
Opening a workspace triggered the extension to run a hidden npx task that fetched and executed an obfuscated JavaScript payload from the orphan commit using the Bun runtime.
The payload searched local files, process memory, cloud metadata services, password-manager vaults, and developer tools for credentials and secrets, including GitHub, npm, AWS, HashiCorp Vault, Kubernetes, 1Password, and Claude Code data.
Stolen data was exfiltrated through HTTPS, GitHub API commits or artifacts in victim repositories, and DNS tunneling.
On macOS, the payload installed a Python backdoor as a LaunchAgent. It polled GitHub Search for signed commands and executed downloaded content; on Linux, it attempted passwordless-sudo privilege escalation.
Defensive Notes: Update Nx Console to version 18.100.0 or later and treat systems that ran version 18.95.0 as compromised.
Rotate every credential reachable from an affected machine, including credentials in files, password managers, cloud metadata, remote secret stores, and process memory. Review access logs and rotate secrets the compromised credentials could reach.
Inspect and remove the listed backdoor and persistence artifacts, stop orphaned daemon processes, and review GitHub, cloud, Vault, 1Password, npm, and package-attestation activity for unauthorized actions.
Audit packages for unauthorized publishes and inspect their contents; the article warns that valid signatures or provenance alone may not establish that a package is legitimate.
For high-sensitivity environments, reimage affected machines after credential rotation rather than relying only on targeted cleanup.

Indicators of compromise

Type	Indicator	Context
SHA1	`558b09d7ad0d1660e2a0fb8a06da81a6f42e06d2`	Git object ID of the malicious orphan commit planted in nrwl/nx to deliver the payload.
SHA256	`1a4afce34918bdc74ae3f31edaffffaa0ee074d83618f53edfd88137927340b8`	SHA-256 of the malicious Nx Console VSIX, version 18.95.0.
SHA256	`43f2b001846c4966073ebffa5be8f15e491a1e7d32bbd805d57406ff540e0dd9`	SHA-256 of the package.json in the malicious dropper package.
SHA256	`b0cefb66b953e5184b6adb3035e9e267335ac5eabfe1848e07834777b9397b74`	SHA-256 of the malicious main.js injected into the compromised extension.
SHA256	`e7347d90653efc565f03733a95e9209d78f9cfa81e31ff2b2dd9d48d75a4b8b1`	SHA-256 of the obfuscated malicious index.js payload from the orphan commit.