Nx Console VS Code Extension Compromised: Credential Theft

Security Alert: Malicious Nx Console VS Code Extension Leads to Credential Theft and GitHub Breach

A significant security incident has been confirmed involving a compromised version of the popular Nx Console VS Code extension (nrwl.angular-console), which led to the theft of developer credentials and a subsequent breach of GitHub’s internal repositories. Developers using the Nx Console extension are urged to take immediate action to mitigate potential risks.

Nature of the Compromise

On May 18, 2026, a malicious version, v18.95.0, of the Nx Console VS Code extension was published to both the Visual Studio Marketplace and the Open VSX registry. This compromised version was available for download between approximately 12:30 and 13:09 UTC. The extension, which boasts over 2.2 million installations, was engineered to act as a credential stealer, specifically targeting sensitive information from VS Code developers who installed it.

Impact on Users and GitHub

The malicious v18.95.0 of the Nx Console extension posed a direct threat to developers, potentially exposing their API keys, authentication tokens, and other sensitive credentials stored or used within their VS Code environments.

Furthermore, this incident directly impacted GitHub. The company officially confirmed that a breach of its internal repositories was a direct consequence of this poisoned version of the Nx Console extension being present on an employee’s device. Attackers reportedly leveraged access gained through this compromise to pull data from approximately 3,700 internal GitHub repositories, highlighting the severe supply chain risk posed by compromised development tools.

Immediate Actionable Recommendations for Developers

Given the severity and nature of this compromise, developers using the Nx Console VS Code extension are strongly advised to take the following immediate steps:

• Check Your Installed Version: Verify the version of your nrwl.angular-console extension. If you have version v18.95.0 installed, or any version from the affected period, consider it compromised.
• Update or Reinstall Safely: If you are on the malicious v18.95.0, uninstall it immediately. Regardless of your current version, ensure you are running the latest safe version of the Nx Console extension by updating through the VS Code Extensions panel or reinstalling from a trusted source after verifying its integrity.
• Revoke Credentials: Assume that any sensitive credentials (e.g., GitHub Personal Access Tokens, npm tokens, cloud provider API keys, SSH keys) used or stored within your VS Code environment while the malicious extension was active may have been compromised. Immediately revoke and regenerate these credentials. Prioritize GitHub tokens due to the confirmed breach.
• Monitor for Suspicious Activity: Scrutinize your GitHub account activity, connected services, and any integrated CI/CD pipelines for unusual or unauthorized actions. Enable multi-factor authentication (MFA) on all critical accounts if you haven’t already.
• Consider System Re-imaging: For highly sensitive development environments or if there’s any doubt about the extent of the compromise, consider a full system re-image to ensure complete removal of any persistent malware.

This incident underscores the critical importance of supply chain security in software development and the need for vigilance when installing third-party extensions. Developers should remain alert for further advisories from Nx and GitHub.