The compromised Nx Console 18.95.0 incident is a serious reminder that developer tools have become a direct path into enterprise environments. According to the report, a malicious version of the Nx Console extension was published to the VS Code Marketplace and, once a developer opened a workspace, it silently fetched and executed an obfuscated payload from an orphan commit inside the official nrwl/nx GitHub repository. The extension has over 2.2 million VS Code installations, which makes this kind of compromise especially dangerous.

What makes this attack particularly concerning is that it targeted developer secrets, not just machines. The payload was described as a multi-stage credential stealer that could harvest secrets from 1Password vaults, Claude Code configurations, npm, GitHub, AWS, SSH keys, and other developer environments, and exfiltrate them through HTTPS, the GitHub API, and DNS tunneling. Because apparently stealing passwords was not dramatic enough, attackers now go directly after the pipelines, tokens, and build systems that software teams depend on. 

Organizations using Nx Console should immediately check whether version 18.95.0 was installed during the exposure window of May 18, 2026, 2:36 p.m. to 2:47 p.m. CEST, upgrade to 18.100.0 or later, remove the listed artifacts and suspicious processes, and rotate all credentials accessible from affected developer systems. This should include GitHub tokens, npm tokens, AWS keys, SSH keys, CI/CD secrets, API keys, and any secrets stored in local development tools. 

The larger lesson is that supply-chain security cannot stop at production servers. Developer workstations, IDE extensions, package managers, build tools, and CI/CD identities must be monitored and governed with the same seriousness as critical infrastructure. Enterprises should maintain extension inventories, restrict unapproved marketplace plugins, monitor token usage, enforce least privilege for developer credentials, and use rapid secret revocation workflows. In modern attacks, compromising the developer environment may be more valuable than attacking the final application, because the developer machine often holds the keys to the kingdom, neatly arranged for attacker convenience.

Cybersecurity researchers have flagged a compromised version of the Nx Console extension that was published to the Microsoft Visual Studio Code (VS Code) Marketplace. The extension in question is rwl.angular-console (version 18.95.0), a popular user interface and plugin for code editors like VS Code, Cursor, and JetBrains. The VS Code extension has more than 2.2 million installations. The Open

Source: Compromised Nx Console 18.95.0 Targeted VS Code Developers with Credential Stealer via The Hacker News — published 19 May 2026.