Nx Console Malicious Extension: How a 17-Minute VS Code Update Led to the GitHub Breach, What Happened Next, and What to Check Now
A poisoned Nx Console update stole developer keys in May 2026, and GitHub says a poisoned extension led to the theft of its internal code. Here is what is confirmed, what happened next and what to check now.
Where United States · North America, United States & Canada, Worldwide
On this page 8 sections
In May 2026, a poisoned update to Nx Console, a widely used Visual Studio Code extension, ran a credential stealer on the developer machines that opened it, taking GitHub, npm, cloud and SSH keys. GitHub says a poisoned VS Code extension on one employee's device led to the theft of its internal repositories, which shows how one editor add-on on one laptop can expose a company's code.
The vendors have now published their findings and two men have been charged over a wider software supply chain campaign. This post covers what is confirmed, what happened next, and what a business with in-house developers or outside contractors should still check.
What happened with the Nx Console extension
Nx Console (extension ID nrwl.angular-console) is an add-on for VS Code and for editors built on it, such as Cursor. Nx published its postmortem on May 21, 2026. It shows the attack started a week before the bad release:
- May 11, 2026: an attacker published malicious versions of 42 TanStack npm packages. A Nx contributor installed one of them,
@tanstack/zod-adapter1.166.15, about 77 minutes after it went up. Its install script ran a credential harvester. Nx says the malware took the contributor's GitHub CLI token and used it against the GitHub API within 74 seconds of running. - May 15 to 16: the stolen token was used again from a different client. Nx gives the last observed use as 00:04 UTC on May 16.
- Monday, May 18, 12:30 UTC: the attacker published Nx Console 18.95.0 under that contributor's name. Nx's release pipeline did not require a second person to approve a publish.
- 12:47 UTC: Nx removed the release from the Visual Studio Marketplace, about 17 minutes after upload. It stayed up on Open VSX, the marketplace many VS Code forks use, until 13:09 UTC, about 36 minutes in total.
Nx's own summary gives the Marketplace window as about 11 minutes. That figure is counted from when the publisher email arrived at 12:36. The timeline in the same post puts the upload at 12:30, so 17 minutes is the fuller figure.
Another detail matters for anyone who runs JavaScript builds. The contributor's project had a seven-day "minimum release age" rule to block brand-new packages. But the project pinned pnpm 10.14, which silently ignores that setting. Nx says pnpm 10.16 or later honors it.
What the malicious version did
When the extension activated, it fetched and ran a hidden payload. Nx and StepSecurity, a security firm that analysed it, say it collected:
- GitHub tokens from config files,
~/.git-credentials, environment variables and process memory - npm tokens, AWS credentials, HashiCorp Vault tokens and Kubernetes tokens
- an open 1Password CLI session, SSH keys,
.envfiles, Google Cloud credentials and Docker config
It sent the data out over HTTPS, the GitHub API and DNS. It also set itself up to keep running: a Python backdoor and, on macOS, a LaunchAgent. On Linux it tried to change sudoers, and on Windows it installed a Bun runtime.
What is confirmed and what is only claimed
| Point | Status |
|---|---|
| Nx Console 18.95.0 was malicious; 18.100.0 and later are clean | Confirmed by Nx (advisory GHSA-c9j4-9m59-847w) |
The Nx build tool (nx npm package), @nx/* plugins and Nx Cloud |
Not affected, per Nx |
| 28 Marketplace installs, 41 Open VSX downloads from 21 IP addresses, about 6,000 extension activations | Nx's figures; Nx says the true number may be significantly higher |
| A poisoned third-party VS Code extension compromised a GitHub employee's device on May 18 | Confirmed by GitHub, whose post links to the Nx advisory |
| About 3,800 GitHub internal repositories were taken | The attacker's claim; GitHub calls it "directionally consistent" but has not confirmed a number |
| Customer repositories were affected | GitHub says it has no evidence of this, though some internal repositories hold customer information such as excerpts of support conversations |
| TeamPCP was behind the GitHub breach | Stated by StepSecurity; GitHub's post does not name a group |
What happened next
GitHub rotated its signing keys. In a May 26 update, GitHub said it was rotating keys, including the GitHub Enterprise Server (GHES) signing key that customers use to confirm GHES packages really come from GitHub. GitHub says every binary it hosts is valid. Even so, GHES administrators must rotate the GPG public keys on their instance with GitHub's rotate-gpg.sh script. The script runs once as the admin user and again with sudo, on every node. If you skip this, future upgrades fail with "The file provided is not a valid GitHub Enterprise Server package." GitHub Enterprise Cloud customers do not need to do anything. GitHub also told GHES customers to expect security updates "at an increased rate over the coming months."
Two men were charged in Australia. On August 27, 2026, the Australian Federal Police announced charges against a 21-year-old from Cottesloe and a 23-year-old from Mandurah: 14 offences between them, in a joint operation with the FBI and Western Australia Police. According to the release, the syndicate inserted malicious code into open-source software, compromised more than 1,000 organisations and stole more than 500,000 credentials. The FBI's Brett E. Leatherman said the men are "allegedly members of the cybercriminal group TeamPCP."
What is not known: the AFP release names no software at all, not Nx, GitHub or TanStack. It does not confirm that these charges cover this attack. And arrests do not cancel stolen credentials. A token taken in May that was never rotated may still work today.
How to check if you were affected
| Check | How | If you find it |
|---|---|---|
| Installed version | Run code --list-extensions --show-versions and look for nrwl.angular-console@18.95.0 |
Update to 18.100.0 or later and treat the machine as compromised |
| Exposure window | Did the machine have Nx Console with auto-update on between 12:30 and 13:09 UTC on May 18? | Nx says to assume compromise |
| Leftover files, macOS and Linux | ~/.local/share/kitty/cat.py, ~/Library/LaunchAgents/com.user.kitty-monitor.plist, /var/tmp/.gh_update_state, /tmp/kitty-*, unexpected sudoers entries |
Remove, rotate everything, consider a full rebuild |
| Leftover files, Windows | %USERPROFILE%\.local\share\kitty\cat.py, %TEMP%\.gh_update_state, %USERPROFILE%\.bun\bin\bun.exe, scheduled tasks or Run keys with those names |
Same as above |
| Running processes | A Python process running cat.py, or any process with __DAEMONIZED=1 |
Isolate the machine |
| Credentials | GitHub, npm, SSH keys, AWS, Google Cloud, Azure, Kubernetes, Vault, .env values |
Rotate all of them, not only the ones stored on disk |
| GitHub audit logs | Unexpected workflow runs, deleted workflow runs, commits from unfamiliar authors | Investigate before trusting recent releases |
| GHES servers | Has rotate-gpg.sh been run on every node? |
Run it before your next upgrade |
| pnpm version | Is minimum-release-age actually enforced? |
Move to pnpm 10.16 or later |
Why this matters for a company network
A developer's laptop is often the most valuable machine in a company. It can push code, deploy your website or app, and read cloud secrets. An editor extension runs with the same access as the developer, and extensions can update themselves without anyone clicking anything.
That applies to people you do not employ directly. If an agency or freelancer builds or maintains your website or app, their machines hold your keys too. Ask them whether anyone on the account ran Nx Console 18.95.0, and whether they rotated credentials afterwards. If you run GitHub Enterprise Server yourself, the key rotation above is a job for this week, not your next upgrade night.
Nx Console malicious extension questions people are asking
Which Nx Console version was malicious?
Version 18.95.0 of nrwl.angular-console. Version 18.100.0 and later are safe, according to Nx.
How long was the bad Nx Console version online?
About 17 minutes on the Visual Studio Marketplace (12:30 to 12:47 UTC on May 18, 2026) and about 36 minutes on Open VSX.
Is the Nx build tool itself affected?
No. Nx says the nx npm package, the official @nx/* plugins and Nx Cloud were not affected.
Do GitHub customers need to do anything?
GitHub Enterprise Cloud customers do not. GitHub Enterprise Server administrators must rotate the GPG public keys with GitHub's script, or future upgrades will fail.
Were the TeamPCP arrests about this attack?
That is not confirmed. The Australian charges describe a supply chain campaign but name no software or victims.
Is VS Code safe to use?
The editor was not the flaw. The attacker used a stolen publisher token to push a bad extension update. The risk is in extensions, and in who can publish them.
The bigger lesson
The attacker had the stolen token for a week before publishing anything, and a publisher email is what alerted Nx. Credentials sitting in plain files on developer machines are the real prize. The fixes are short-lived tokens, a second approver for every release, a quick rotation after any upstream incident, and checking that a security setting is actually enforced by the tool version you run.
To have your development machines, release pipeline and servers reviewed, see security hardening or request a quote.
Get security alerts like this by email, with the free checklist, at security alerts.
Sources: Nx: Nx Console v18.95.0 postmortem; GitHub: investigation update and GHES signing key rotation; Australian Federal Police media release; StepSecurity: Nx Console extension compromised.
Have a question about this article?
Ask it here and we will answer you directly by email. Questions are private, never posted.
Security alerts by email
Hear about the next one first.
When attackers start using a flaw in software businesses run on, we email what it is, whether it touches you and what to do that week, with a round-up of our latest security writing. Free, one-click unsubscribe. You get the checklist straight away: 12 things to secure this week.
Want a result like this?
Security alerts, breaches and the technology a business runs on: what happened, who it affects and what to do.
Get a Tech QuoteKeep reading
Fireworks AI Breach: A Hacked Cloud Provider Let Attackers Reach Customer Billing Data, Datasets and Model Weights, and What to Do Now
Fireworks AI says attackers used a hacked third-party cloud provider to reach its development machines and cus...
strutil-core Malware: Malicious Ruby Gem Steals Developer Credentials and Can Wipe Home Folders, and What to Check This Week
Version 1.0.1 of the Ruby gem strutil-core ran a credential-stealing worm during installation. Here is what So...
Vanderbilt Cyberattack: Campus Told to Shut Down Devices, BYOD Ransomware Gang Claims Data Theft, and What Businesses Should Plan This Week
Vanderbilt University told students and staff to shut down university devices after a cyberattack on November...
