erroneo.us
Search all guides⌘K

Security Digest · May 18, 2026 · Supply-chain compromise · Other

Nx Console 18.95.0: Hijacked VS Code Extension Release

A malicious Nx Console 18.95.0 on VS Code Marketplace and Open VSX stole developer secrets on May 18, 2026 (CVE-2026-48027). Check machines, rotate.

Published By erroneo.us Security Desk · Updated 3 min read7 sources

Our verdict

Check exposure

The bad build was live for under 40 minutes in May 2026, but it planted a backdoor and stole every credential it could reach, so any machine that ran it should be treated as compromised until checked and its secrets rotated.

Who must act: Any developer or organization whose VS Code, Cursor or other fork had Nx Console installed with auto-update between 12:30 and 13:09 UTC on May 18, 2026, or that finds 18.95.0 or its indicators on a machine.

Who can relax: Users who never had Nx Console 18.95.0, and users of the Nx CLI, @nx/* npm plugins and Nx Cloud, which were not affected.

Affected
Nx Console (nrwl.angular-console) 18.95.0 only, from the Visual Studio Marketplace (12:30-12:47 UTC) and Open VSX (12:33-13:09 UTC) on May 18, 2026
Fixed in
Nx Console 18.100.0 and later
CVSS
9.3 (v4.0, CNA)
EPSS
1.3% (percentile 71)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Run code --list-extensions --show-versions | grep angular-console on every developer machine, and check the extensions folder of any VS Code fork.
  2. Update Nx Console to 18.100.0 or later.
  3. On any machine that had 18.95.0, kill processes with __DAEMONIZED=1 or cat.py, unload the com.user.kitty-monitor LaunchAgent, and delete the kitty and .gh_update_state artifacts.
  4. Rotate every credential the machine could reach: GitHub, npm, SSH, AWS, GCP, Kubernetes, Vault, 1Password items, .env values and AI or MCP API keys.
  5. Audit GitHub org audit logs, npm publish history and cloud logs for activity by those identities since May 18, 2026, and reimage high-value machines.
  6. Require a second person to approve extension and package releases, and keep gh CLI tokens out of plain files.

How to check if you are affected or compromised

  • code --list-extensions --show-versions | grep angular-console (18.95.0 means the build was installed)
  • ls -la ~/.local/share/kitty/cat.py ~/Library/LaunchAgents/com.user.kitty-monitor.plist /var/tmp/.gh_update_state /tmp/kitty-* (Windows: %USERPROFILE%\.local\share\kitty\cat.py, %TEMP%\kitty-*, %USERPROFILE%\.bun\bin\bun.exe)
  • ps eww -ax | grep -E '__DAEMONIZED|cat\.py' for live backdoor processes
  • grep -rl 558b09d7 ~/.npm/_cacache/index-v5 for npm cache entries of the github:nrwl/nx#558b09d7 dropper
  • Unexpected entries in /etc/sudoers or /etc/sudoers.d on Linux, and outbound requests to api.github.com/search/commits?q=firedalazer

What happened#

At 12:30 UTC on May 18, 2026, a malicious Nx Console 18.95.0 (extension ID nrwl.angular-console) was published to the Visual Studio Marketplace. It went live on Open VSX at 12:33. A maintainer spotted the publish email, and the build came off the Marketplace at 12:47 and Open VSX at 13:09, per the Nx advisory.

The Nx postmortem traces it to the May 11 TanStack npm compromise. A contributor's pnpm install pulled a malicious @tanstack/zod-adapter, which stole the GitHub CLI token in ~/.config/gh/hosts.yml. At the time, any core contributor could release Nx Console without a second approval.

StepSecurity's analysis shows injected code in main.js that runs when any workspace opens. It launches a hidden VS Code task that runs npx -y github:nrwl/nx#558b09d7..., an orphan commit pushed with the stolen token. That installs Bun and runs an obfuscated index.js, which daemonizes with __DAEMONIZED=1. It collects GitHub tokens (including from process memory), npm tokens, AWS metadata and Secrets Manager values, Vault, Kubernetes and 1Password CLI secrets, SSH keys, .env files and ~/.claude/. Data leaves over HTTPS, the GitHub API and DNS. On macOS a Python backdoor, ~/.local/share/kitty/cat.py, is installed as a LaunchAgent. Every hour it searches GitHub commits for firedalazer and runs signed commands it finds there. On Linux the payload tries to add a sudoers rule.

Who is affected#

Only 18.95.0 is affected, and 18.100.0 and later are clean. Microsoft counted 28 Marketplace installs and Open VSX 41 downloads. Nx's own telemetry, however, showed about 6,000 activations, all but one from VS Code (one from Cursor). The Nx CLI, @nx/* plugins and Nx Cloud were not affected.

One victim was GitHub: an employee's device was compromised through the extension and about 3,800 internal repositories were taken, BleepingComputer reports, in an attack attributed to TeamPCP.

The CVE record scores it CVSS 4.0 9.3 and NVD CVSS 3.1 9.8. (The record says May 19; the advisory timeline says May 18.) CISA added it to KEV on May 27, 2026 and marks it as known to be used in ransomware campaigns. This is a separate incident from the August 2025 s1ngularity nx npm attack.

Do you really need to act?#

Only if a machine had 18.95.0, but check rather than assume: Nx warns that extension auto-update could have installed it without anyone clicking. The theft ran once, the backdoor stayed and could take new orders, and any token not rotated since May still works. If no machine shows the version or the indicators below, you are done.

What to do now#

  1. On each developer machine, run code --list-extensions --show-versions | grep angular-console. Check the extension folders of Cursor and other forks too.
  2. Update Nx Console to 18.100.0 or later.
  3. Where 18.95.0 or an indicator turns up, kill processes with __DAEMONIZED or cat.py. Run launchctl unload ~/Library/LaunchAgents/com.user.kitty-monitor.plist, then delete the files listed below.
  4. Rotate everything that machine could reach: GitHub, npm, SSH, AWS, GCP, Kubernetes, Vault, 1Password items, .env values, and AI and MCP API keys.
  5. Review GitHub org audit logs, especially deleted workflow runs and pushes to .github/workflows/, plus npm publish history and CloudTrail. Reimage sensitive machines.

How to tell if you were hit#

On macOS and Linux, look for ~/.local/share/kitty/cat.py, ~/Library/LaunchAgents/com.user.kitty-monitor.plist, /var/tmp/.gh_update_state and /tmp/kitty-*. On Windows, look for %USERPROFILE%\.local\share\kitty\cat.py, %TEMP%\kitty-*, %TEMP%\.gh_update_state and %USERPROFILE%\.bun\bin\bun.exe.

Find live processes with ps eww -ax | grep -E '__DAEMONIZED|cat\.py', search the npm cache for 558b09d7, check /etc/sudoers.d, and look in proxy logs for api.github.com/search/commits?q=firedalazer.

Timeline#

  • — The TanStack npm compromise steals a contributor's GitHub CLI token.
  • — Malicious 18.95.0 is live from 12:30 to 13:09 UTC. Nx publishes GHSA-c9j4-9m59-847w at 17:01.
  • — GitHub discloses its internal repository breach.
  • — Nx publishes its postmortem.
  • — CVE-2026-48027 is published and CISA adds it to KEV. The federal deadline is June 10.

Vulnerability records

  • CVE-2026-48027 · KEV 2026-05-27 · Nx Console is the user interface for Nx & Lerna.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Nx — GHSA-c9j4-9m59-847w: Compromised Nx Console version 18.95.0 github.com
  2. Nx — Nx Console v18.95.0 postmortem nx.dev
  3. CVE record — CVE-2026-48027 cve.org
  4. NVD — CVE-2026-48027 nvd.nist.gov
  5. CISA — Known Exploited Vulnerabilities: CVE-2026-48027 cisa.gov
  6. StepSecurity — Nx Console VS Code extension compromised stepsecurity.io

Coverage and analysis

  1. BleepingComputer — GitHub links repo breach to TanStack npm supply-chain attack bleepingcomputer.com