Cybersecurity researchers have flagged a compromised version of the Nx Console extension that was published to the Microsoft Visual Studio Code (VS Code) Marketplace.
The extension in question is rwl.angular-console (version 18.95.0), a popular user interface and plugin for code editors like VS Code, Cursor, and JetBrains. The VS Code extension has more than 2.2 million installations. The Open VSX version has not been affected by the incident.
“Within seconds of a developer opening any workspace, the compromised extension silently fetched and executed a 498 KB obfuscated payload from a dangling orphan commit hidden inside the official nrwl/nx GitHub repository,” StepSecurity researcher Ashish Kurmi said.
The payload is a “multi-stage credential stealer and supply chain poisoning tool” that harvests developer secrets and exfiltrates them via HTTPS, the GitHub API, and DNS tunneling. It also installs a Python backdoor on macOS systems that abuses the GitHub Search API as a dead drop resolver for receiving further commands.
In an advisory issued Monday, the maintainers of the extension said the root cause has been traced to one of its developers, whose machine was compromised in a recent security incident that leaked their GitHub credentials. Although the nature of the prior “incident” was not disclosed, the developer’s credentials have since been temporarily revoked.
The access afforded by the credentials is said to have been abused to push an orphaned, unsigned commit to nrwl/nx, which introduces the stealer malware. The malicious action is triggered as soon as a developer opens any workspace in VS Code, leading to the installation of the Bun JavaScript runtime to run an obfuscated “index.js” payload.
The malware runs checks to avoid infecting machines likely located in the Russian/CIS time zones and launches itself as a detached background process to kick off the credential harvesting workflow, allowing it to retrieve secrets from 1Password vaults and Anthropic Claude Code configurations, and secrets associated with npm, GitHub, and Amazon Web Services (AWS).
“One capability that stands out: the payload contains full Sigstore integration, including Fulcio certificate issuance and SLSA provenance generation,” StepSecurity said. “Combined with stolen npm OIDC tokens, this means the attacker could publish downstream npm packages with valid, cryptographically signed provenance attestations, making the malicious packages appear as legitimate, verified builds.”
The Nx team also acknowledged a “few users were compromised” as a result of this breach. Besides urging users to update to 18.100.0 or later, the maintainers have published the following indicators of compromise –
- Nx Console version 18.95.0 was installed during the exposure window between May 18, 2026, at 2:36 p.m. CEST and 2:47 p.m. CEST.
- Presence of files like ~/.local/share/kitty/cat.py, ~/Library/LaunchAgents/com.user.kitty-monitor.plist, /var/tmp/.gh_update_state, or /tmp/kitty-*.
- Presence of any of the following running processes: a python process running cat.py and a process with __DAEMONIZED=1 in its environment.
Affected users are recommended to terminate the aforementioned processes, delete artifacts on disk, and rotate all credentials reachable from the affected machine, including tokens, secrets, and SSH keys.
The development marks the second time the Nx ecosystem has been targeted within a year. In August 2025, several npm packages were infected by a credential stealer as part of a supply chain attack campaign named s1ngularity. Unlike the previous iteration, the latest attack targets the VS Code extension.
Malicious npm Packages Galore
The findings coincide with the discovery of various malicious packages in the open-source repositories –
- iceberg-javascript, supabase-javascript, auth-javascript, microsoft-applicationinsights-common, and ms-graph-types: Five npm packages containing a hidden ELF binary that backdoors Claude Code sessions to steal developer credentials.
- noon-contracts: an npm package that impersonates a Noon Protocol smart contract SDK to exfiltrate SSH keys, crypto wallet private keys, AWS credentials, Kubernetes secrets, all .env files, shell history, Docker/Git/npm tokens, and browser wallet storage paths.
- martinez-polygon-clipping-tony, a trojanized fork of martinez-polygon-clipping that uses a postinstall hook to download a 17MB PyInstaller-packed Windows remote access trojan (RAT) that uses Telegram for command-and-control (C2) for remote shell execution, screenshot capture, file upload/download, and arbitrary Python execution.
- common-tg-service: an npm package that contains functionality to take over a victim’s Telegram account while masquerading as “Common Telegram service for NestJS applications.”
- exiouss: an npm package that bundles a ChatGPT and OpenAI session cookie stealer targeting web browsers like Google Chrome, Microsoft Edge, and Brave.
- k8s-pod-checker, dev-env-setup, and node-perf-utils: three npm packages part of the kube-health-tools cluster that install a large language model (LLM) proxy service on the victim’s machine, allowing the attacker to route LLM traffic through the compromised server
- A coordinated credential harvesting campaign orchestrated by an Indonesian-speaking threat actor using a set of 38 npm packages that leverages dependency confusion as a way to trick CI/CD pipelines to resolve malicious public packages ahead of legitimate private ones associated with Apple, Google, and Alibaba, among others.
- An unusual campaign wherein seven npm packages under the @hd-team organization have been found to act as a stager for configurations used by a Chinese sports gambling and pirated streaming platform named Douqiu to determine the backend servers to connect to.
