CVE-2026-48027

What is Nx Console?

Nx Console is the official VS Code extension for Nx, a widely-used monorepo build system and developer tooling framework from Nrwl. With over 2.2 million installs, Nx Console provides GUI-based task runners, code generators, and project graph visualization for TypeScript monorepos. It is a core part of many enterprise development workflows at organizations including OpenAI, Grafana Labs, and Mistral AI.

Overview

CVE-2026-48027 is a supply-chain attack in which a malicious version of the Nx Console VS Code extension (18.95.0) was published to both the VS Code Marketplace and OpenVSX on May 18, 2026. The compromised extension fetched a 498 KB obfuscated JavaScript payload from an orphan commit (558b09d7) in the official nrwl/nx repository — a commit with no branch parent, invisible to standard repository browsing. Upon workspace open, the payload ran silently within seconds and harvested credentials from a broad range of sources. CISA confirmed active exploitation and added the CVE to the KEV catalog on May 27, 2026, with a deadline of June 10, 2026.

The attack was enabled by the prior TanStack supply-chain compromise (CVE-2026-45321), in which a contributor's GitHub credentials were stolen. Those credentials were used to push the orphan payload commit and publish the malicious extension under the legitimate nrwl publisher identity.

Affected Versions

Technical Details

The attack exploited VS Code's auto-update mechanism to silently push the malicious update to a fraction of the 2.2M+ install base during the exposure window.

The malicious payload (fetched from orphan commit 558b09d7) harvested credentials from multiple sources:

• GitHub tokens matching prefixes ghp_, gho_, ghs_
• npm auth tokens from .npmrc
• AWS credentials (IMDS endpoint and ~/.aws/credentials)
• GCP metadata service
• Kubernetes service-account tokens
• HashiCorp Vault token files
• 1Password CLI vault data
• SSH private keys
• Docker credential stores
• Process memory (regex scan on Linux via /proc/*/mem)
• Claude Code configuration (~/.claude/settings.json)

Exfiltration used three simultaneous channels: HTTPS POST to a C2 server, the GitHub API (using the victim's own stolen tokens to push data to attacker-controlled repositories), and DNS tunneling. On macOS, the payload also installed a Python backdoor at ~/.local/share/kitty/cat.py that polled the GitHub Search API for RSA-PSS-signed commands.

Stolen npm OIDC tokens were used with Sigstore/Fulcio to publish downstream packages with valid SLSA provenance, making the downstream packages appear legitimately signed.

Discovery

The compromise was detected within 11 minutes by Nx maintainer jaysoo, who noticed an unexpected upload notification and immediately unpublished the extension. StepSecurity subsequently published a detailed IOC analysis tracing the root cause to the TanStack credential theft.

Exploitation Context

CISA confirmed active exploitation. Credentials harvested via the malicious extension were used to breach approximately 3,800 GitHub internal repositories and compromise developer machines at OpenAI, Grafana Labs, and Mistral AI. The attack chain originated with the TanStack Mini Shai-Hulud worm campaign (CVE-2026-45321), attributed to the threat actor group TeamPCP.

Remediation

1. Update Nx Console to version 18.100.0 or later — the first clean release following the incident.
2. Rotate all credentials if Nx Console 18.95.0 was installed at any point on May 18, 2026:
   • GitHub personal access tokens and OAuth tokens
   • npm authentication tokens
   • AWS access keys and GCP service account keys
   • Kubernetes service-account tokens
   • SSH private keys and HashiCorp Vault tokens
   • 1Password CLI credentials and Docker credentials
3. Check for the macOS backdoor: ls ~/.local/share/kitty/cat.py — remove if present.
4. Audit GitHub repository access logs for unexpected pushes or API calls originating from your tokens during May 18, 2026.
5. Review VS Code auto-update settings — consider disabling automatic extension updates and pinning extension versions in managed environments.
6. For federal agencies: apply mitigations per CISA Alert AA26-148A before June 10, 2026.