A new software supply chain incident has affected the Nx Console extension for Visual Studio Code, exposing developers to credential theft and potential downstream compromise.
The compromised extension is rwl.angular-console version 18.95.0, a popular UI and productivity plugin used with editors such as VS Code, Cursor, and JetBrains. The VS Code extension has more than 2.2 million installations, making this incident especially serious for developer environments and CI/CD security.
According to StepSecurity, the malicious version silently fetched and executed an obfuscated payload shortly after a developer opened any workspace. The Open VSX version was not affected.
What Happened?
The Nx team traced the root cause to a developer whose machine had been compromised in a previous security incident, resulting in leaked GitHub credentials.
Those credentials were then abused to push an orphaned, unsigned commit into the official nrwl/nx GitHub repository. This commit contained the malicious payload used by the compromised extension.
The attack was triggered when a developer opened a workspace in VS Code with the affected extension version installed. From there, the extension downloaded the Bun JavaScript runtime and executed an obfuscated index.js payload.
This made the attack dangerous because it did not require the user to manually run a command or interact with a suspicious file. Opening a workspace was enough to trigger the malicious workflow.
A Multi-Stage Credential Stealer
The malicious payload has been described as a multi-stage credential stealer and supply chain poisoning tool.
Once executed, it attempted to harvest sensitive developer secrets and exfiltrate them through several channels, including:
- HTTPS
- GitHub API
- DNS tunneling
The payload was designed to steal credentials and secrets from high-value developer tools and platforms, including:
- 1Password vaults
- Anthropic Claude Code configurations
- npm tokens
- GitHub credentials
- AWS credentials
- local developer secrets
- SSH keys and other accessible tokens
The malware also attempted to avoid infecting systems likely located in Russian or CIS time zones, a common technique used by some threat actors to reduce local law enforcement risk.
macOS Backdoor Capability
On macOS systems, the payload also installed a Python backdoor.
This backdoor abused the GitHub Search API as a dead drop resolver, allowing attackers to receive further commands through GitHub-hosted search results rather than a traditional command-and-control server.
This technique can make detection harder because traffic to GitHub may appear normal in developer environments.
The published indicators of compromise include suspicious files such as:
~/.local/share/kitty/cat.py~/Library/LaunchAgents/com.user.kitty-monitor.plist/var/tmp/.gh_update_state/tmp/kitty-*
Affected users were also advised to look for running processes such as a Python process executing cat.py or a process with __DAEMONIZED=1 in its environment.
Why This Attack Is Especially Dangerous
Developer workstations are high-value targets because they often contain direct access to the software supply chain.
A compromised developer machine may expose:
- source code repositories
- package publishing tokens
- GitHub tokens
- cloud credentials
- CI/CD secrets
- SSH keys
- API keys
- password manager data
- AI coding assistant configuration files
- deployment credentials
If attackers steal these secrets, they may be able to publish malicious packages, access private repositories, compromise cloud infrastructure, or poison downstream builds.
This turns one compromised extension into a potential entry point for a much larger supply chain attack.
Sigstore and SLSA Abuse Raises the Stakes
One of the most concerning capabilities identified by StepSecurity was the payload’s support for Sigstore integration, including Fulcio certificate issuance and SLSA provenance generation.
In simple terms, this means the attacker may have been preparing to publish downstream packages that appear cryptographically signed and legitimate.
This is a serious escalation.
Security teams increasingly rely on signed provenance and build attestations to verify that software came from a trusted source. If attackers steal npm OIDC tokens and abuse legitimate signing workflows, they may be able to make malicious packages look like verified builds.
That undermines trust not only in individual packages, but in the software supply chain verification process itself.
Timeline and Affected Version
The affected version was Nx Console 18.95.0.
The maintainers stated that users may have been exposed if this version was installed during the exposure window between:
May 18, 2026, 2:36 p.m. CEST and 2:47 p.m. CEST
Although this window appears short, the impact can still be significant because extensions can update automatically and developer machines often contain highly sensitive credentials.
The Nx team has urged users to update to version 18.100.0 or later.
Indicators of Compromise
Users should review systems for the following indicators:
Affected extension version
- Nx Console
18.95.0
Suspicious files
~/.local/share/kitty/cat.py~/Library/LaunchAgents/com.user.kitty-monitor.plist/var/tmp/.gh_update_state/tmp/kitty-*
Suspicious processes
- Python process running
cat.py - Process containing
__DAEMONIZED=1in its environment
If any of these indicators are found, the machine should be treated as compromised.
What Affected Users Should Do
Developers and organizations that may have installed the affected version should respond quickly.
Recommended steps include:
- update Nx Console to 18.100.0 or later
- terminate suspicious processes
- delete known malicious artifacts from disk
- rotate all credentials reachable from the affected machine
- rotate GitHub tokens and SSH keys
- rotate npm tokens and package publishing credentials
- rotate AWS credentials and cloud access keys
- review 1Password and password manager access
- review Claude Code and AI assistant configuration files
- check GitHub audit logs for suspicious activity
- review npm package publishing history
- check CI/CD pipelines for unauthorized changes
- review recent commits, tags, releases, and package versions
- monitor for suspicious DNS tunneling or unusual GitHub API usage
Because the payload targeted developer secrets broadly, credential rotation should not be limited only to Nx-related credentials.
A Repeat Attack on the Nx Ecosystem
This is not the first time the Nx ecosystem has been targeted.
In August 2025, several npm packages connected to the ecosystem were infected with a credential stealer as part of a supply chain attack campaign known as s1ngularity.
The latest incident is different because it targets the VS Code extension rather than npm packages. This shows how attackers are expanding their focus across the entire developer toolchain.
Threat actors are no longer targeting only dependencies. They are also targeting:
- IDE extensions
- package managers
- CI/CD workflows
- GitHub Actions
- developer machines
- AI coding tools
- package signing workflows
- cloud credentials
- password managers
The software supply chain now includes every tool developers use to write, build, test, sign, and publish code.
Malicious Packages Continue to Flood Open-Source Repositories
The Nx Console incident comes alongside several other malicious package campaigns affecting open-source ecosystems.
Recent examples include npm packages designed to:
- backdoor Claude Code sessions
- steal developer credentials
- exfiltrate SSH keys and crypto wallet private keys
- steal AWS and Kubernetes secrets
- harvest
.envfiles and shell history - deploy Windows remote access trojans
- take over Telegram accounts
- steal ChatGPT and OpenAI session cookies
- install LLM proxy services on victim machines
- abuse dependency confusion against private package names
This shows that attackers are heavily focused on developer environments because they offer access to credentials, automation, infrastructure, and trusted distribution channels.
Defensive Lessons for Organizations
This incident highlights several important defensive priorities.
1. Treat IDE extensions as software supply chain dependencies
VS Code extensions should be reviewed, approved, and monitored like any other third-party dependency.
2. Restrict automatic extension installation where possible
Organizations should consider extension allowlists, managed developer environments, or policy-based controls for high-risk teams.
3. Reduce local secret exposure
Avoid storing long-lived credentials on developer machines. Use short-lived tokens, identity federation, and just-in-time access where possible.
4. Monitor developer endpoints
Developer laptops and workstations should have strong endpoint detection, logging, and response capabilities.
5. Rotate secrets after suspicious activity
If a developer machine is compromised, assume all accessible secrets may be exposed.
6. Review package signing and provenance workflows
Signed builds help, but they are not enough if attackers can steal the credentials used to create trusted signatures.
Final Thoughts
The compromised Nx Console extension is another reminder that developer tools are now prime targets for supply chain attacks.
A trusted IDE extension with millions of installations can become a powerful distribution channel for credential theft. In this case, the malicious payload targeted not only common developer credentials, but also password managers, AI coding assistant configurations, GitHub tokens, npm publishing access, AWS credentials, and software provenance workflows.
For security teams, the message is clear: protecting production systems is not enough. Developer environments, IDE extensions, CI/CD pipelines, package publishing workflows, and local secrets must all be treated as critical infrastructure.
The modern software supply chain starts on the developer workstation.
