ctipilot.ch

Nx Console VS Code extension 18.95.0 compromised — stolen publisher credentials; 11-minute window 2026-05-18 12:36-12:47 UTC; multi-channel stealer + macOS Python backdoor

incident · item:nx-console-vs-code-extension-18-95-0-compromised-stolen-publ

Coverage timeline
1
first 2026-05-20 → last 2026-05-20
Briefs
1
1 distinct
Sources cited
15
8 hosts
Sections touched
1
active_threats
Co-occurring entities
0
no co-occurrence

Story timeline

  1. 2026-05-20CTI Daily Brief — 2026-05-20
    active_threatsFirst-coverage; 2.2M-install extension; harvests GitHub/npm/AWS/HashiCorp/K8s/1Password secrets; safe ver 18.100.0+

Where this entity is cited

  • active_threats1

Source distribution

  • attack.mitre.org7 (47%)
  • cert.ssi.gouv.fr2 (13%)
  • cybersecuritynews.com1 (7%)
  • thehackernews.com1 (7%)
  • ivanti.com1 (7%)
  • microsoft.com1 (7%)
  • securityweek.com1 (7%)
  • stepsecurity.io1 (7%)

All cited sources (15)

Items in briefs about Nx Console VS Code extension 18.95.0 compromised — stolen publisher credentials; 11-minute window 2026-05-18 12:36-12:47 UTC; multi-channel stealer + macOS Python backdoor (1)

Nx Console VS Code extension (2.2 M installs) compromised via stolen publisher credentials — 11-minute window 2026-05-18 12:36–12:47 UTC

From CTI Daily Brief — 2026-05-20 · published 2026-05-20 · view item permalink →

On 2026-05-18 between 12:36 and 12:47 UTC, version 18.95.0 of the Nx Console VS Code extension (nrwl.angular-console, 2.2+ million installs) was pushed to the Visual Studio Marketplace using stolen publisher credentials. The malicious version activated on any workspace open, fetching a 498 KB obfuscated payload from a dangling orphan commit on the official nrwl/nx GitHub repository; the injected code amounted to 2,777 bytes inserted into the minified main.js (CybersecurityNews, 2026-05-19). The payload is a multi-stage stealer harvesting tokens from GitHub, npm, AWS, HashiCorp Vault, Kubernetes kubeconfigs, and 1Password, exfiltrating over three independent channels: HTTPS, GitHub API as dead-drop, and DNS tunnelling. On macOS the loader installs a persistent Python backdoor using the GitHub Search API as command channel, with messages signed with a 4096-bit RSA key (The Hacker News, 2026-05-19). Safe version: 18.100.0 or later.

Why it matters to us: Any developer who opened a workspace during the 11-minute window with Nx Console installed should treat every credential accessible from that machine as compromised — that includes corporate GitHub PATs that grant access to public-sector repos, cloud-deployment credentials, and any secret manager whose CLI ever ran on that host. The pattern — abuse of marketplace publisher credentials to push a transient malicious version, with the malicious binary itself short-lived enough to evade most retrospective scanning — generalises beyond Nx Console; expect imitators.