On May 18, 2026 attackers published a trojanized version of the Nx Console VS Code extension (nrwl.angular-console v18.95.0) with 2.2 million prior installs. The malicious build was live in the Visual Studio Code Marketplace for just 11 minutes before being pulled, but in that window it fetched a 498 KB obfuscated payload from an orphan commit inside the official nrwl/nx GitHub repository and ran it the moment a developer opened any workspace.
The payload was a multi-stage credential stealer that harvested tokens from GitHub, npm, AWS, HashiCorp Vault, Kubernetes and 1Password and exfiltrated them over three channels: HTTPS, the GitHub API and DNS tunneling. The threat group TeamPCP used a stolen contributor personal access token to push the orphan commit at 03:18 UTC, then claimed responsibility on cybercrime forums and advertised approximately 3,800 internal GitHub repositories stolen from affected organizations.
Developers are urged to upgrade Nx Console to 18.100.0 or later, scrub any backdoor persistence on their machines, and rotate all credentials touched by VS Code, including GitHub PATs, npm tokens, SSH keys, cloud credentials and anything in .env files.