# Compromised Nx Console Extension Deployed Multi-Stage Credential Stealer to 2.2 Million VS Code Developers
A malicious version of the popular Nx Console extension was published to the Microsoft Visual Studio Code Marketplace on May 18, 2026, delivering a sophisticated credential stealer to developers worldwide. The attack—one of the most significant supply chain incidents targeting developer tools this year—exposed a critical vulnerability in how open-source projects manage security credentials and developer machine access.
The compromised extension (rwl.angular-console, version 18.95.0) infected an estimated 2.2 million installations before being removed from the marketplace. Security researchers from StepSecurity disclosed that the payload harvested credentials from 1Password vaults, Anthropic Claude Code configurations, npm, GitHub, and AWS—effectively giving attackers a skeleton key to downstream development pipelines.
## The Threat: A Credential Stealer in the Developer Toolchain
The attack window was remarkably narrow: May 18, 2026, from 2:36 p.m. to 2:47 p.m. CEST—an 11-minute exposure window that still managed to compromise "a few users," according to the Nx team. The malware executed silently and automatically as soon as a developer opened any workspace in VS Code.
Key attack characteristics:
The threat actors leveraged a simple but devastating vector: they compromised a single developer's machine, stole their GitHub credentials, and used those credentials to push an unsigned, malicious commit directly into the official Nx repository.
## Background and Context: The Nx Ecosystem Under Siege
This marks the second significant supply chain attack against the Nx ecosystem in less than a year. In August 2025, a campaign named "s1ngularity" infected multiple npm packages with credential stealers. That attack targeted the npm registry directly. This latest incident is more alarming because it targeted the VS Code extension—a tool that developers consider trusted and essential to their workflow.
The Nx Console is not a fringe utility. It is deeply integrated into the development experience of teams using Nx monorepos, a build system increasingly adopted by large enterprises. The 2.2 million installations represent a broad attack surface spanning startups to Fortune 500 companies.
Why developers are now the primary target:
| Attack Vector | Scope | Detection Difficulty |
|---|---|---|
| Infected npm package | Affects downstream consumers of the package | Medium |
| Compromised extension | Reaches the developer's machine directly | High |
| Stolen dev credentials | Enables lateral movement into CI/CD pipelines | Very High |
Developers are no longer just victims of supply chain attacks—they have become the primary vulnerability in the delivery chain. A single compromised developer credential can cascade into dozens of downstream projects.
## Technical Details: From Credential Theft to Supply Chain Poisoning
### The Attack Flow
The malware employed a sophisticated multi-stage approach:
1. Bun runtime injection: The payload installed the Bun JavaScript runtime to execute obfuscated JavaScript code
2. Obfuscated "index.js": A 498 KB payload that performed geofencing, credential harvesting, and persistence
3. Geofencing checks: Avoided infecting machines in Russian/CIS time zones (likely to avoid local law enforcement attention)
4. Detached process launch: Ran credential harvesting in the background, allowing the malware to persist undetected
### Credential Harvesting Scope
The malware targeted multiple secret stores and configurations:
Each stolen credential represents a potential pivot point for the attacker to move laterally into corporate infrastructure.
### The Sigstore Integration: A Turning Point in Supply Chain Attacks
The most alarming aspect of this malware was its integration with Sigstore and SLSA provenance generation:
> "The payload contains full Sigstore integration, including Fulcio certificate issuance and SLSA provenance generation. Combined with stolen npm OIDC tokens, this means the attacker could publish downstream npm packages with valid, cryptographically signed provenance attestations, making the malicious packages appear as legitimate, verified builds."
This capability represents a fundamental shift in supply chain attack sophistication. Traditionally, defenders could identify malicious packages by checking for valid cryptographic signatures. This attack flips that model: attackers could now forge legitimate-looking signatures using stolen OIDC tokens, making it nearly impossible for automated security tooling to distinguish malicious packages from legitimate ones.
### Exfiltration Mechanisms
The malware exfiltrated stolen credentials through three separate channels:
## Implications: A Crisis for Developer Security Posture
### Immediate Exposure
Any developer who installed Nx Console 18.95.0 between May 18-19 should assume the following credentials are compromised:
### Downstream Risk
Organizations relying on developers from compromised machines face substantial downstream risk. An attacker with stolen GitHub credentials and npm OIDC tokens could:
### The Broader Pattern
This incident demonstrates that open-source projects remain inadequately equipped to defend against developer credential compromise. The Nx team's response—tracing the breach to a developer's compromised machine—highlights a systemic weakness: organizations invest heavily in securing repositories and pipeline infrastructure, but the weakest link remains the developer's local environment.
## Recommendations: Immediate and Long-Term Actions
### For Affected Developers (Urgent)
1. Update immediately to Nx Console 18.100.0 or later
2. Scan your machine for indicators of compromise:
- ~/.local/share/kitty/cat.py
- ~/Library/LaunchAgents/com.user.kitty-monitor.plist
- /var/tmp/.gh_update_state
- /tmp/kitty-* (any files matching this pattern)
3. Check running processes for:
- Python processes running cat.py
- Any process with __DAEMONIZED=1 environment variable
4. Terminate malicious processes immediately
5. Rotate all credentials: GitHub tokens, npm tokens, AWS keys, 1Password passphrases, SSH keys, API keys
6. Review git history on machines where the extension was installed to check for suspicious commits
7. Monitor your GitHub account for unauthorized push events
### For Organizations
1. Audit developer machine security: Implement mandatory security baselines including EDR (Endpoint Detection and Response) tools
2. Enforce credential rotation: Require developers to rotate tokens and secrets on a regular schedule, not just after incidents
3. Monitor package publishing: Track all npm package publications from your organization with signature verification and SLSA attestation checks
4. Implement SBOM tracking: Maintain software bill-of-materials (SBOM) for all dependencies to understand exposure
5. Review CI/CD access controls: Limit which developer credentials can publish packages; use OIDC tokens with minimal scopes
6. Conduct threat hunts: Review git logs and CI/CD pipeline executions during the exposure window for suspicious activity
### For the Broader Ecosystem
1. Extension marketplace governance: VS Code Marketplace should implement mandatory code signing and more rigorous vetting before allowing extensions with sensitive capabilities to be published
2. Developer credential hygiene: The industry needs better standards for protecting and compartmentalizing developer secrets (workspaces, secret rotation, minimal-privilege access)
3. Supply chain transparency: Projects should publish security incident response plans and timelines publicly to build trust
---
## HackWire Analysis
This incident marks a watershed moment in supply chain security: the attackers didn't just compromise a package, they compromised a developer's ability to build trustworthy packages. By stealing npm OIDC tokens alongside Sigstore integration, they weaponized the very cryptographic tools designed to prevent this kind of attack.
The timing and sophistication suggest a coordinated operation. The attacker knew exactly which credentials to steal (npm OIDC tokens, Sigstore certificates) to achieve maximum downstream impact. This is not script-kiddie activity—this is a targeted operation with deep knowledge of modern supply chain security infrastructure.
What makes this particularly dangerous: traditional defenses fail here. Your organization's SBOM tracking won't catch this. Your code signing verification won't catch this. A package signed with valid SLSA provenance and a legitimate npm OIDC token *looks legitimate* because the cryptography is legitimate. The only way to detect this attack is behavioral analysis of the resulting packages or network forensics to detect C2 callbacks.
The Nx team's response was comparatively fast (under 12 hours), but it illustrates a broader problem: when developer credentials are compromised, the breach window can be measured in minutes, not days. Organizations cannot afford to wait for quarterly credential audits or annual security assessments. Developers need real-time credential monitoring, and the ecosystem needs stronger isolation between development credentials and deployment authority.
— HackWire Editorial
---
## Related Coverage