Nx Console VS Code Malware (CVE-2026-48027): How a Poisoned Extension Update Reached GitHub's Internal Code, and What to Check on Developer Machines Now

On May 18, 2026, someone published a poisoned version of Nx Console, a Visual Studio Code extension used by developers, and it stole credentials from the machines that ran it. One of those machines belonged to a GitHub employee. That led to the theft of GitHub's internal repositories, and the cleanup was still going on a week later. If anyone who writes or maintains code for your business uses VS Code, it is worth confirming that version 18.95.0 never ran on their machine, and that any keys it could reach have been changed.

What happened to the Nx Console extension

According to Nx's own postmortem, the trouble started a week earlier in a different project. On May 11, an Nx contributor ran a routine pnpm install that pulled in a malicious TanStack package (@tanstack/zod-adapter@1.166.15). That exposed the contributor's GitHub CLI token. The attacker used the token to get into Nx's repositories, and then on May 18 published Nx Console 18.95.0 through the project's own release pipeline. At the time, one person could publish a release without anyone else signing off.

The confirmed timeline, all in UTC on Monday, May 18, from the Nx postmortem and advisory:

CISA's May 28 alert adds an important detail: the bad version spread through VS Code's automatic updates. Developers who already had Nx Console installed may have received it without clicking anything.

When a developer opened a project, the extension quietly downloaded and ran a hidden program. Nx says it collected credentials from the disk and from memory, including GitHub tokens, npm tokens, AWS credentials, HashiCorp Vault tokens, 1Password CLI vault contents when a session was open, private keys and database connection strings. It sent data out over HTTPS, the GitHub API and DNS. On Linux it tried to give itself permanent admin rights through sudoers, and on macOS it installed a backdoor that started at login.

How many developers got the bad update

The counts disagree, and Nx says so openly:

• Visual Studio Marketplace: 28 installs, per Microsoft.
• Open VSX: 41 downloads from 21 unique IP addresses.
• Nx's own telemetry: about 6,000 activations. Nx notes these are activations, not installs, and was still working the numbers out with Microsoft. Its advisory warns the real number of affected users may be in the thousands.

One early research write-up said Open VSX was not affected. Nx's own postmortem says it was, for 36 minutes, about three times as long as the Microsoft marketplace, because Open VSX sends publishers no email and nobody thought to check it at first.

What happened next: GitHub's internal repositories

On May 20, GitHub posted that "on Monday May 18, we detected and contained a compromise of an employee device involving a poisoned VS Code extension published by a third party." GitHub's post does not name the extension in its text, but it links to the Nx Console advisory, and CISA's alert ties the two together. GitHub said:

• The activity involved stealing GitHub's internal repositories only.
• The attacker's claim of about 3,800 repositories is "directionally consistent" with its investigation.
• It has no evidence that customer information stored outside those repositories was affected, but some internal repositories hold customer information, such as excerpts from support conversations.

In a May 26 update, GitHub said it was rotating keys, including the GitHub Enterprise Server (GHES) signing key. Companies that run their own GHES have to run a GitHub script to install the new key, or future upgrades will fail with "The file provided is not a valid GitHub Enterprise Server package." GitHub also told GHES customers to expect security updates more often in the months ahead.

CISA added the flaw to its Known Exploited Vulnerabilities catalog as CVE-2026-48027 on May 27, and gave federal agencies a June 10 deadline.

What is claimed but not confirmed

• Who did it. StepSecurity writes that "TeamPCP is behind the GitHub breach and is attempting to sell the stolen data." GitHub has not named an attacker.
• AI assistant credentials. StepSecurity reports that the program also went after Claude Code settings (~/.claude/settings.json), which can hold API keys and MCP server details. That item does not appear in Nx's own list.
• What is not known: which GitHub repositories were taken, and whether credentials stolen from other Nx Console users have since been used.

How to check for Nx Console 18.95.0 this week

Uninstalling the extension does not undo the theft. Credentials taken in May stay valid until someone changes them. Elastic's research found that stolen credentials get used within minutes, so a key that was never rotated is still a live risk.

Why a poisoned VS Code extension matters for a business

A developer's laptop is not just one computer. It usually holds the keys to your source code, cloud account, deployment pipeline and sometimes production databases. Whether that developer is on staff, a contractor or an agency you hired, their editor extensions update themselves in the background, and nobody at your company approved this one.

The Nx postmortem is honest about what made this possible: a release pipeline one person could publish from alone, a GitHub token any local program could read, and a pnpm setting meant to hold back brand-new packages that their pnpm version simply ignored. Your own setup could have every one of those gaps. If you are not sure who checks the tools your vendors use, start with who is patching the software that runs your business.

CISA's advice for organizations fits on one line: wait at least three hours before pulling a new package, pin software to specific trusted versions, and pull only from known sources.

Nx Console malware questions people are asking

Which version of Nx Console was malicious?

Only 18.95.0, published May 18, 2026. Nx says 18.100.0 or later is clean.

Is Nx Console safe to use now?

Nx says to be on 18.100.0 or later. Nx also says the Nx CLI, @nx/* plugins and Nx Cloud were not affected.

Did the Nx Console hack affect GitHub customers?

GitHub says it has no evidence of impact to customer information stored outside its internal repositories, though some of those repositories contain support-conversation excerpts. Companies running GitHub Enterprise Server need to install the new signing key.

What is CVE-2026-48027?

It is the ID for the malicious Nx Console 18.95.0 release. CISA lists it as an embedded malicious code vulnerability that has been exploited in real attacks.

I updated the extension. Am I safe?

Not by itself. If 18.95.0 ran on the machine, rotate every credential it could reach and check for the leftover files and processes listed above.

The bigger lesson

This attack hopped from a TanStack package to an Nx contributor, then to an extension update, then to GitHub, and each step was a trusted tool doing what it normally does. Patching closes the hole. Rotating keys and requiring a second person to approve every release are what stop the next hop.

If you want your development tools, pipelines and servers reviewed, see security hardening or request a quote.

Get security alerts by email, plus our free checklist, at security alerts.

Sources: Nx Console v18.95.0 postmortem; Nx Console advisory GHSA-c9j4-9m59-847w; GitHub: Investigating unauthorized access to GitHub's internal repositories; CISA: Supply Chain Compromises Impact Nx Console and GitHub Repositories; CISA KEV entry for CVE-2026-48027; StepSecurity analysis.