Compromised Nx Console 18.95.0 Targeted VS Code Developers with Credential Stealer

A compromised Nx Console VS Code extension (v18.95.0) deployed a multi-stage credential stealer targeting developers.

• •The malware harvested secrets from 1Password vaults, Claude Code configurations, npm, GitHub, and AWS credentials
• •Attack exploited developer credentials used to push unsigned malicious commits to the nrwl/nx GitHub repository
• •Payload included Sigstore integration to forge legitimate npm packages using stolen OIDC tokens
• •Exposure window: May 18-19, 2026, affecting 2.2+ million extension users

This summary was automatically generated by AI based on the original article and may not be fully accurate.