What Happened
On May 18, 2026, security researchers discovered that version 18.95.0 of the Nx Console extension for Visual Studio Code had been published with malicious code designed to steal developer credentials, cloud infrastructure tokens, and CI/CD secrets. The extension — installed by over 2.2 million developers worldwide — was quietly turned into a multi-stage credential harvester targeting anyone who opened a workspace in VS Code, Cursor, or JetBrains IDEs. According to The Hacker News, the malicious version was published outside the normal CI/CD pipeline, likely using stolen maintainer credentials, and remained live on the official Microsoft VS Code Marketplace before being flagged.
Technical Analysis
The attack was notably sophisticated. The injected payload was an obfuscated ~498 KB JavaScript file that executed on every workspace activation — meaning every time a developer opened a project, the malware ran. StepSecurity's analysis revealed the payload was a multi-stage credential stealer that specifically targeted environment variables, configuration files, and shell profiles where developers typically store AWS keys, Azure tokens, GitHub PATs, and npm credentials. The extension identifier — nrwl.angular-console — made it appear legitimate, and the version bump to 18.95.0 followed enough of a pattern that automated update systems pulled it without suspicion.
The attack vector bypassed standard code review because the malicious version was pushed directly to the marketplace rather than going through the project's open-source repository. This is a pattern increasingly seen in supply chain attacks: compromise the publishing pipeline, not the source code. CyberSecurityNews reported that the payload specifically searched for .env files, ~/.aws/credentials, ~/.npmrc, ~/.docker/config.json, and shell profile files like .bashrc and .zshrc, exfiltrating found secrets to an attacker-controlled endpoint.
Who's Affected
The scale is significant. With 2.2 million installations across VS Code, Cursor, and JetBrains, Nx Console is one of the most widely used developer tooling extensions in the ecosystem. It's particularly popular among teams using the Nx build system for monorepo management — a pattern common in enterprise environments where a single compromised developer machine can expose entire cloud infrastructures. SecurityOnline noted that the attack surface extends beyond individual developers: any CI/CD pipeline that relies on credentials stored in a developer's local environment could be downstream-compromised. This follows the same playbook as the 2025 s1ngularity attack on the Nx build system itself, suggesting the Nx ecosystem is being systematically targeted by threat actors.
How to Protect Yourself
If you have Nx Console installed, take these steps immediately:
- Check your version: Open VS Code → Extensions → Nx Console. If you're on version 18.95.0, uninstall immediately and revert to the last known good version.
- Rotate all credentials: Assume any secrets stored in environment variables,
.envfiles,~/.aws/credentials,~/.npmrc, or shell profiles on machines where the extension was installed have been compromised. Rotate AWS keys, Azure tokens, GitHub PATs, npm tokens, and Docker registry credentials. - Audit recent activity: Check cloud provider logs (AWS CloudTrail, Azure Activity Log, GCP Audit Logs) for unauthorized access in the window between when you last updated the extension and now.
- Pin extension versions: Use VS Code's extension auto-update pinning to prevent silent updates. Only update extensions after verifying the changelog and checking for security advisories.
- Isolate secrets from dev machines: Use a dedicated secrets manager (HashiCorp Vault, AWS Secrets Manager, 1Password) rather than storing credentials in local files. This limits the blast radius of any single compromised developer workstation.
The Sable Angle
Supply chain attacks on developer tooling are no longer theoretical — they're the fastest-growing attack vector in 2026. The Nx Console compromise follows the same pattern we've tracked in our research on open-source supply chain vulnerabilities and the security gaps in startup development workflows. The common thread: attackers know that developers are the soft underbelly of enterprise security, and a single compromised extension can bypass millions of dollars in perimeter defenses.
At Sable, our offensive security team regularly tests exactly these attack paths — from compromised IDE extensions to poisoned CI/CD pipelines. If your organization uses Nx, monorepos, or any developer tooling at scale, our penetration testing and red team engagements can identify where your supply chain is exposed before an attacker finds it. The cost of a proactive assessment is a fraction of what a single stolen cloud credential can cost in a breach.