Nx Console 18.95.0 trojanized: a VS Code extension update that stole developer credentials

Who is affected

This is not a coding mistake. Someone got hold of publishing access and deliberately shipped a booby-trapped version. CWE-506 (Embedded Malicious Code) is the category for exactly that.

Time on each marketplace: VS Code Marketplace about 12:30–12:48 UTC, Open VSX about 12:33–13:09 UTC. The official counts are 28 installs from the Microsoft Marketplace and 41 downloads from Open VSX (21 unique IPs), but Nx’s own analytics recorded about 6,000 activations. The vendor explains that the numbers measure different things (installs versus activations).

How it works

Nx’s postmortem breaks the incident into four linked failures:

1. An upstream package was compromised first. On 2026-05-11 attackers published malicious versions of 42 @tanstack/* npm packages (CVE-2026-45321).
2. A safety setting silently did nothing. An Nx contributor ran a routine install in another project. That project had a 7-day “minimum release age” rule that should have skipped very new packages, but the rule needs pnpm 10.16 or later and the project was pinned to pnpm 10.14, which quietly ignores settings it doesn’t know. A malicious TanStack version only 77 minutes old got installed.
3. An unprotected CLI token. The contributor’s GitHub CLI token was within reach of local programs: the config file ~/.config/gh/hosts.yml, the gh auth token command, or the memory of a running gh process. The post-mortem says it has not established which path the malware took, only that it obtained and used the token within 74 seconds of running. The attacker used it from May 11 to May 16, pushing commits and deleting workflow runs.
4. One person could publish. Unlike Nx’s other products, publishing Nx Console needed no second approver.

On May 18 the malicious 18.95.0 was uploaded, and the Marketplace recorded the upload as coming from the compromised contributor. The advisory says the stolen credentials let the attacker run workflows as a contributor, but the vendor has not said exactly which token or path was used.

According to StepSecurity’s analysis, a small loader was injected into the extension’s main file. As soon as the extension started (for example, when a workspace was opened), the loader fetched a package from an “orphan” commit the attacker had pushed into the official nrwl/nx repository, installed the Bun runtime, and ran a heavily obfuscated payload. The key point: the malware was served from the project’s own trusted repository, not an obviously suspicious domain.

Behaviour confirmed by the vendor: it harvested Vault tokens, Kubernetes and AWS IAM auth, npm .npmrc tokens and npm OIDC token exchange, AWS instance metadata, Secrets Manager, SSM and Web Identity tokens, GitHub tokens and Actions secrets, process memory, 1Password CLI content (only if an op CLI session was signed in at the time), private keys, connection strings, and GCP and Docker credentials; sent them out over HTTPS, the GitHub API and DNS; and on Linux tried to add itself to sudoers to persist.

Behaviour reported only by StepSecurity (third party): reading the Claude Code settings file ~/.claude/settings.json, scanning process memory on Linux, encrypting data before sending it, installing an hourly Python backdoor on macOS that took signed commands via GitHub search, and generating Sigstore/SLSA provenance so stolen npm tokens could publish packages with valid-looking signatures.

The flawed release setup (conceptual illustration, not Nx’s actual configuration):

# Any contributor with write access can trigger a direct publish to the marketplace
publish:
  steps:
    - run: publish-extension   # no second approver

The fixed approach:

# The publish job is bound to an environment that needs review
publish:
  environment: release        # two admins must approve; the approver can't be the person who triggered it
  steps:
    - uses: some/action@<full commit SHA>   # Actions pinned to an exact SHA
    - run: publish-extension

A second lesson is that “configured” is not the same as “enforced”: protections like a minimum release age only work if the tool version you actually run supports them; otherwise they may be silently ignored.

Timeline

Further reading

• Scoring differences: the 9.8 shown on this page is NVD’s CVSS 3.1 score; GitHub (the CNA) scores it 9.3 under CVSS 4.0. Both mark it as needing no user action, which fits the fact that auto-update alone delivered it. The GitHub advisory page showed no CWE or score when viewed, but the CVE record GitHub published carries CWE-506 and 9.3.
• Dates and durations disagree: the CVE/NVD description says May 19; every other source says May 18, which this page uses. Accounts of how long it stayed on the VS Code Marketplace also differ: the GHSA advisory and CVE record say 12:30 to 12:48, about 18 minutes. Nx’s postmortem timeline says it was unpublished at 12:47, about 17 minutes after upload and about 11 minutes after the 12:36 notification email, yet the same post’s opening summary says the package was “live ~11 minutes”, and StepSecurity, citing the official advisory, also says about 11. The sources don’t explain the gap (for example, whether upload time equals the time it became downloadable), so this page lists both.
• Ransomware flag: the CISA KEV record marks known ransomware campaign use as “Known”. This page reports that as CISA’s classification. None of the sources we read connects ransomware directly to the Nx Console incident. The only link is a group-level claim, relayed by Tenable and Snyk (Snyk attributes it to Unit 42, based on a BreachForums announcement), of a partnership between TeamPCP and the Vect ransomware group, and SANS reports the Vect leak site was still inactive in early June.
• The GitHub breach: GitHub called the attacker’s claims “directionally consistent” with its investigation and found no evidence that customer data outside internal repositories was affected. It rotated its secrets and its GitHub Enterprise Server signing key; GHES administrators must rotate the GPG key so future updates install. GitHub made no attribution.
• The wider campaign: security vendors call the upstream TanStack wave “Mini Shai-Hulud” and attribute it to TeamPCP. The TanStack advisory itself names no campaign, Unit 42 notes the worm’s source code went public on May 12, and SANS calls attribution for later waves ambiguous. Vendors also count the waves differently. No source says the Nx Console malware itself spread like a worm.
• Signed isn’t safe: the upstream TanStack packages carried valid SLSA Build Level 3 provenance. A valid signature proves which pipeline built a package, not that the code is harmless.
• AI angle: StepSecurity reports the payload read Claude Code’s settings file; the Nx postmortem does not mention AI at all.
• StepSecurity calls this the second supply-chain attack on Nx in under a year, after an npm incident in August 2025; we have not checked that against a primary source.
• Unconfirmed: why versions 18.96 to 18.99 were skipped, and whether the JetBrains plugin was affected.