Poisoned Nx Console 18.95.0 VS Code extension steals developer credentials and leads to GitHub breach (CVE-2026-48027)
A tampered Nx Console 18.95.0 for VS Code was live for under 40 minutes on 18 May and stole credentials, keys and 1Password CLI data. It led to GitHub's internal repositories being stolen. If you ran it, update to 18.100.0+ and rotate every secret.
If you use Nx Console in VS Code or Cursor, check you are on version 18.100.0 or later and not 18.95.0. If 18.95.0 ran on your machine, rotate every GitHub, npm, cloud, SSH and 1Password credential it could reach, and ask your IT or security team to rebuild the machine.
What’s happening
On 18 May 2026 an attacker published a tampered version of Nx Console, a popular VS Code extension for developers, using a contributor's stolen GitHub login. Version 18.95.0 was live on the Visual Studio Marketplace for roughly 18 minutes and on Open VSX for about 36, and reached users through automatic updates. It downloaded a hidden payload that harvested cloud, GitHub, npm, SSH, Vault and 1Password command-line credentials and set up persistence on the machine. Nx recorded about 6,000 VS Code activations of the bad version and says true impact may be higher. The fixed version is 18.100.0 or later. A GitHub employee's device was compromised, and GitHub's internal repositories were stolen; reports put the number at about 3,800, and the TeamPCP group claimed the theft. CISA lists CVE-2026-48027 as exploited, including by ransomware groups. GitHub has said critical secrets were rotated and a fuller report would follow; the pages read here do not show that report, or any arrests or charges.
- What
- Poisoned software
- Affects
- Nx Console extension for Visual Studio Code and Open VSX (version 18.95.0)
- Affected
- Nx Console 18.95.0 (VS Code extension, Visual Studio Marketplace and Open VSX); forks such as Cursor also exposed
- Fixed in
- 18.100.0 and later
- Since
- 18 May 2026
- Closed
- 28 May 2026
Timeline
- Update
CISA's alert said the poisoned extension was used to compromise a GitHub employee's device and exfiltrate internal repositories. It told organisations to revert unauthorised changes by automated accounts, especially those after 2026-05-18.
- CISA added
CISA added CVE-2026-48027 (the malicious Nx Console build) to its Known Exploited Vulnerabilities list, noting use by ransomware groups.
- Wider attacks
GitHub said an employee's device had been compromised through a malicious VS Code extension. Reports put the stolen internal repositories at about 3,800, and the TeamPCP group claimed the theft and offered the data for sale. GitHub said it rotated critical secrets and would publish a fuller report.
- New fixFixed
Nx published its security advisory naming 18.95.0 as the bad version and 18.100.0 as the fixed one, and listing credentials to rotate. Nx later said about 6,000 VS Code activations of the bad version were recorded, though true impact may be higher.
- Made publicPartly fixed
Using the contributor's access, the attacker published Nx Console 18.95.0 to the Visual Studio Marketplace and Open VSX. A maintainer spotted an unexpected publisher notice; Marketplace removed it at about 12:47-12:48 UTC and Open VSX at 13:09 UTC.
- Made public
A contributor to Nx Console ran an install in an outside project and pulled a poisoned TanStack package from the wider Mini Shai-Hulud campaign. It stole the contributor's GitHub command-line login token, which the attacker then used for about five days (last seen 2026-05-16).
Sources
- Compromised Nx Console 18.95.0 (GHSA-c9j4-9m59-847w)Nx · 18 May 2026
- Nx Console v18.95.0 postmortemNx · 18 May 2026
- CISA alert on Nx Console and GitHub compromiseCISA · 28 May 2026
- GitHub Breach Traced to Malicious 'Nx Console' VS Code ExtensionInfosecurity Magazine · 19 May 2026