Nx Console VS Code extension shipped credential stealer

Nine months after a high-profile worm called s1ngularity tore through the Nx ecosystem, a new attacker briefly published a malicious version of the popular Nx Console VS Code extension on the Visual Studio Marketplace and OpenVSX on May 18, 2026, and according to StepSecurity this one came closer to abusing Sigstore for legitimate-looking provenance attestations than any earlier supply-chain compromise.

Nx Console is a Visual Studio Code companion to the Nx build system. After the 2025 s1ngularity incident, Nrwl added a manual-approval gate to the nx npm publish pipeline, but Nx Console kept an older setup in which a single organization member could publish unattended. Nrwl's own postmortem traces the entry point to May 11, when a contributor ran pnpm install in an external repository at 20:43 UTC. That project's .npmrc set minimum-release-age=10080, a seven-day quarantine on new releases, but the pinned pnpm 10.14 predated support for the setting and ignored it silently, so the install pulled @tanstack/zod-adapter@1.166.15, published 77 minutes earlier. Its prepare script fetched a 2.3 MB obfuscated harvester that took the contributor's GitHub CLI OAuth token. The attacker sat on that access for about five days, deleting workflow runs to cover the trail, before publishing malicious version 18.95.0 on May 18.

The extension fetched and ran an obfuscated, multi-channel credential stealer. StepSecurity, which published the most detailed dissection, said it harvested Vault tokens, .npmrc credentials, AWS metadata endpoints and Secrets Manager entries, GitHub ghp_, gho_, and ghs_ tokens, GitHub Actions secrets, 1Password CLI sessions, on-disk private keys, database connection strings, GCP service accounts, and Docker credentials, exfiltrating over HTTPS, through the GitHub API using the victim's own tokens, and over DNS. On Linux it attempted sudoers injection; on macOS it wrote ~/.local/share/kitty/cat.py and registered a LaunchAgent at ~/Library/LaunchAgents/com.user.kitty-monitor.plist. StepSecurity also found Sigstore code paths in the payload, requesting short-lived signing certificates from fulcio.sigstore.dev, writing log entries to rekor.sigstore.dev, and building slsa.dev/provenance/v1 attestations through npm's OIDC trusted-publisher flow. With the right OIDC material and enough runner time, the attacker could in principle have published follow-on npm versions carrying valid provenance, a meaningful escalation over earlier worms. The exposure window closed first.

Nobody's tooling caught it. A maintainer noticed a routine publisher-notification email from the Visual Studio Marketplace at 12:36 UTC, an upload nobody had authorized, and Nrwl unpublished within 11 minutes; Open VSX was not checked until the primary marketplace was handled, leaving it exposed for 36 minutes. "We did not detect this through any system we built," the postmortem says. Microsoft and OpenVSX reported 28 and 41 downloads for 18.95.0, the latter across 21 unique IPs, while Nrwl's own telemetry counted roughly 6,000 activations over the following two days, and the company told anyone with auto-update enabled during the window to assume compromise. Nrwl shipped 18.100.0, extended the two-reviewer approval gate and pinned Action SHAs to every publish-capable repository, and called the gap an oversight rather than a deliberate scope decision. Affected users were told to update, kill any cat.py or __DAEMONIZED processes, unload the LaunchAgent, delete the persistence files, and rotate every credential reachable from the machine.