CVE-2026-48027: Nx Console VS Code Extension -- Supply Chain Compromise and Credential Theft

Background

Nx Console is a Visual Studio Code extension developed by Nrwl (the creators of the Nx build system) with over 2.2 million installations. It provides a graphical interface for Nx monorepo workspaces, integrating task runners, code generators, and project graph visualisation directly into the VS Code IDE. Its broad adoption across enterprise JavaScript and TypeScript development teams makes it an attractive target for supply chain attacks: a compromised extension executes with full access to the developer’s environment, including credential stores, environment files, and cloud configuration.

CVE-2026-48027 is a critical supply chain compromise in which attackers published a malicious version of Nx Console (v18.95.0) to the Visual Studio Marketplace and Open VSX registry on May 18, 2026. The malicious version was available for approximately 18 minutes on the VS Marketplace and 36 minutes on Open VSX — a short window that was nonetheless sufficient for the extension to reach developer machines and harvest credentials. CISA added CVE-2026-48027 to its Known Exploited Vulnerabilities catalog on May 27, 2026.

The attack is part of the broader “Mini Shai-Hulud” supply chain campaign, in which the attacker (attributed as threat group TeamPCP by StepSecurity) pivoted from a prior compromise of TanStack npm packages (CVE-2026-45321) to Nx Console using credentials stolen from a TanStack developer.

Technical Mechanism

CVE-2026-48027 is classified as CWE-506 (Embedded Malicious Code). The vulnerability is not a code defect in the legitimate Nx Console codebase — it is a direct supply chain compromise in which the attacker obtained publishing credentials for the extension and published a backdoored version.

The attack chain:

1. Initial access: Attackers compromised the npm publishing credentials of a TanStack developer through the Mini Shai-Hulud campaign (see CVE-2026-45321). TanStack’s CI environment ran a GitHub Actions workflow that had access to an Nx developer’s credentials via a shared toolchain.

2. Malicious publication: Using the obtained credentials, the attacker published Nx Console v18.95.0 containing an injected second-stage loader. The loader was obfuscated using standard JavaScript obfuscation techniques and appeared in a dependency that was lazily loaded during extension activation.

3. Payload execution: On first activation, the extension made an outbound HTTPS request to a C2 endpoint to retrieve the credential-harvesting payload. The payload performed a systematic sweep of credential stores accessible from the developer’s environment, targeting:

   • 1Password CLI keychain items and vault exports
   • ~/.config/claude/ and related Anthropic Claude Code credential files
   • ~/.npmrc and scoped registry tokens
   • ~/.gitconfig and stored GitHub credentials/tokens
   • AWS credential files (~/.aws/credentials, ~/.aws/config)
   • Environment variables containing common secret key patterns

4. Exfiltration: Collected credentials were POSTed to a second attacker-controlled endpoint over HTTPS. The exfiltration was designed to blend with normal extension telemetry traffic.

The total malicious code was heavily obfuscated, appearing as a legitimate update-check routine at first glance.

Real-World Exploitation Evidence

The downstream impact of CVE-2026-48027 has been substantial. Using GitHub credentials harvested from developer machines running the compromised extension, threat actors exfiltrated approximately 3,800 GitHub internal repositories. Grafana Labs also disclosed a breach traceable to the same campaign.

The Mini Shai-Hulud campaign (attributed to threat actor group TeamPCP by StepSecurity) has demonstrated a clear pattern of targeting developer credential stores to enable lateral movement into corporate development infrastructure. Prior operations attributed to TeamPCP include the Aqua Security Trivy scanner compromise (March 2026, CVE-2026-33634) and the Bitwarden CLI npm package compromise (April 2026).

The attack is notable for its precision timing and rapid use of harvested credentials, suggesting a well-resourced actor with automated exfiltration and downstream exploitation tooling. The chain from TanStack (CVE-2026-45321) to Nx Console to GitHub’s internal repositories illustrates a “harvest and pivot” strategy that used each breach to enable the next.

Impact Assessment

• Developer workstation compromise: Any developer with VS Code open and auto-update enabled during the 18–36 minute exposure window may have had credentials silently exfiltrated from their local environment.
• Organisational credential exposure: The targeted credential types — AWS keys, GitHub tokens, npm tokens — are frequently used across CI/CD pipelines and production infrastructure. Compromise of a single developer’s machine can provide an attacker with lateral movement paths into cloud environments, production repositories, and deployment systems.
• Downstream breach amplification: The GitHub internal repository breach (3,800 repositories) demonstrates how developer supply chain attacks compound: a short exposure window on a VS Code extension translated into access to internal source code and potentially further secrets embedded in those repositories.
• Trusted extension abuse: VS Code extensions execute in a trusted context with the same permissions as the user running VS Code. There is no sandbox boundary between the extension and the host operating system, making credential sweeping straightforward once an extension is loaded.
• Auto-update attack surface: VS Code’s default auto-update behaviour means users with the extension installed may have been updated to the malicious version without any explicit action on their part.

Affected Versions

Developers who had VS Code open during the exposure window (approximately 12:30–13:09 UTC on May 18, 2026) and whose extension auto-updated are at highest risk. VS Codium, Gitpod, and Eclipse Theia users sourcing extensions from Open VSX had a longer exposure window.

Remediation Steps

1. Verify your installed version. In VS Code, open the Extensions panel, locate Nx Console, and confirm the installed version. If v18.95.0 is present, update immediately to v18.100.0 or later.

2. Treat the developer environment as compromised if Nx Console v18.95.0 was installed and the extension was active during May 18, 2026 approximately 12:30–13:09 UTC.

3. Rotate all credentials. If potentially exposed, rotate immediately:

   • GitHub personal access tokens and fine-grained tokens
   • npm publish tokens and registry credentials
   • AWS access keys accessible from the affected machine
   • Any API keys or secrets stored in environment files or credential managers accessible from the workstation
   • 1Password master password and SCIM bridge tokens if the CLI was installed
   • Anthropic API keys and Claude Code configuration

4. Review CI/CD pipeline access. Revoke and regenerate any deploy keys, service account credentials, or OIDC configurations used from affected developer machines.

5. Check your GitHub organisation audit log for unusual repository cloning, token creation, or webhook additions during May 18–25, 2026. See Detection section for specific queries.

6. Safe version: Nx Console v18.100.0 was released as a clean rebuild following the compromise postmortem. The Nx team has published a postmortem at nx.dev/blog/nx-console-v18-95-0-postmortem describing steps taken to harden their publishing pipeline.

Detection Guidance

Extension version check (developer workstations):

# VS Code CLI
code --list-extensions --show-versions | grep nrwl.angular-console

Credential access indicators:

• Unusual access to ~/.aws/credentials from VS Code extension host processes
• File reads of ~/.npmrc by node processes with VS Code as the parent
• Access to 1Password CLI socket or keychain files outside expected user context
• Modification or new read activity on ~/.config/claude/ configuration files

Log sources:

• EDR process tree: look for node (extension host) spawning outbound connections, child processes, or reading credential files
• macOS Unified Logging / Windows Event Log: file access events on credential paths listed above
• Network flow logs: correlate VS Code process network activity with external POST requests during the exposure window

GitHub audit log review:

# GitHub API  --  review org audit log for the exposure period
GET /organisations/{org}/audit-log?phrase=created:2026-05-18..2026-05-25&include=all

Review for: unusual repository clone operations, new personal access token creation, webhook additions, and changes to organisation security settings during May 18–25, 2026.

Network IOCs:

• Anomalous POST requests from VS Code extension host processes carrying JSON payloads containing structured credential data
• Outbound HTTPS traffic from node processes to non-standard endpoints shortly after VS Code startup

Timeline

References

• NVD — CVE-2026-48027
• CISA KEV — CVE-2026-48027
• MITRE CVE — CVE-2026-48027