Cybersecurity experts have identified a compromised version of the Nx Console extension for the Microsoft Visual Studio Code (VS Code) Marketplace, posing a significant threat to developers. The affected version, rwl.angular-console 18.95.0, is a widely-used interface for code editors, notably VS Code, with over 2.2 million installations. Notably, the Open VSX version remains unaffected.
Details of the Breach
The breach was uncovered by StepSecurity researcher Ashish Kurmi, who reported that as soon as developers opened any workspace, the compromised extension executed an obfuscated payload from a neglected orphan commit in the official nrwl/nx GitHub repository. This payload acts as a multi-step credential stealer, designed to extract developer secrets via various channels including HTTPS and DNS tunneling. A Python backdoor is also deployed on macOS systems, utilizing the GitHub Search API for further commands.
According to an advisory released by the extension’s maintainers, the root cause was traced back to a developer whose machine was compromised, leading to the leak of their GitHub credentials. Though details of the initial incident remain undisclosed, the credentials have been temporarily revoked to prevent further exploitation. These credentials were used to push an unsigned commit injecting the stealer malware, activated when any VS Code workspace is opened.
Implications and Mitigation Steps
The malware conducts checks to avoid infecting systems in Russian/CIS time zones and operates as a background process to collect credentials from various sources, including 1Password vaults, npm, GitHub, and AWS configurations. One notable feature of the malware is its integration with Sigstore for issuing certificates and generating provenance attestations, enabling attackers to publish npm packages that appear legitimate.
The Nx team confirmed that a small number of users were impacted by this breach. Users are urged to update to version 18.100.0 or later and have been provided with indicators of compromise, such as the presence of certain files and processes. Affected users should remove these artifacts and rotate all accessible credentials and secrets.
Ongoing Threats in the Ecosystem
This incident marks the second attack on the Nx ecosystem within a year, following a 2025 attack involving npm packages in a campaign named s1ngularity. In the latest attack, the focus shifted to the VS Code extension. Concurrently, researchers have found various malicious packages in open-source repositories, including npm packages with hidden binaries designed to steal developer credentials.
These packages range from those impersonating legitimate libraries to ones that install remote access trojans or steal session cookies. A coordinated campaign by an Indonesian-speaking threat actor involves 38 npm packages exploiting dependency confusion to deceive CI/CD pipelines, underscoring the ongoing threats faced by developers and the need for enhanced vigilance in the open-source community.
The evolving nature of these attacks highlights the critical need for developers to remain vigilant and adopt robust security practices to safeguard their development environments.
