Reported by 1 outlet
Nx Console VS Code Extension Hijacked — 2.2M Installations Targeted in Supply Chain Attack
Why this score
- Breadth
- 0.50 / 2.0 · 1 source
- Authority
- 1.00 / 2.0 · best outlet weight
- Severity
- 0.80 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Nx Console VS Code Extension Hijacked — 2.2M Installations Targeted in Supply Chain Attack
cyberpress.org · 148d ago · May 19th, 2026
On May 18, attackers compromised version 18.95.0 of the Nx Console VS Code extension (2.2M+ installations) by scraping a contributor's GitHub token from a prior incident, planting an invisible orphan commit in the Nx repository, and publishing the infected extension using compromised marketplace credentials. The payload is a multi-stage credential stealer targeting GitHub, npm, AWS, HashiCorp Vault, Kubernetes, Claude Code configs, and 1Password — with three independent exfiltration channels (HTTPS, GitHub API, DNS tunneling) and a persistent Python backdoor on macOS. The Nx team removed the malicious version within 11 minutes and released version 18.100.0. However, any developer who opened a workspace with the compromised extension should consider all secrets on that machine compromised and reimage the workstation. This is the second supply chain attack on Nx in under a year, and one of the first to specifically target AI coding assistant configurations.