Nx Console and GitHub: dev tools as an entry path

Developer tools can be an entry path into a company, as the Nx Console and GitHub case shows. Nx says a malicious Nx Console 18.95.0 was live on 18 May 2026, and CISA says it spread through VS Code’s automatic update. GitHub says a poisoned extension on an employee device led to the exfiltration of internal repositories. The chain began a week earlier with one stolen token.

What happened with Nx Console and GitHub?

Nx, the maker of the Nx Console editor extension, says an attacker published the malicious version to the Visual Studio Marketplace and the Open VSX registry, using a real Nx contributor’s identity. The payload ran when the extension activated, in VS Code or a fork such as Cursor. It looked for SSH keys, .env files, GCP credentials and Docker config, and sent data out by HTTPS, the GitHub API and DNS-based covert channels.

GitHub says it detected and contained a compromised employee device on Monday 18 May 2026, involving a poisoned third-party VS Code extension. CISA says threat actors used a prior compromise of Nx developer systems to reach that device. Our incident page, Nx Console and GitHub internal repositories, holds the full record. This post looks at the lesson for security teams. No source names an actor, so there is no public attribution.

How did a token stolen on 11 May reach the GitHub repositories?

Nx says the start was one contributor’s machine. During a routine install on 11 May, part of the TanStack compromise, it pulled a malicious package that was 77 minutes old. A credential stealer took the contributor’s GitHub CLI OAuth token. Nx adds that the contributor’s project asked for a seven day package age delay, but an old pnpm version silently ignored it.

Nx says the attacker was active in its GitHub repositories for seven days without detection, and that it did not detect the attack with any system it built. A maintainer received a routine Marketplace upload email that the maintainer did not expect, and unpublished within 11 minutes. Open VSX sends no equivalent email, so the window there was longer.

Is the 3,800 repositories figure confirmed?

Not as a plain fact. GitHub calls the attacker’s claim of about 3,800 repositories directionally consistent with its investigation so far, and says its current assessment is that only GitHub-internal repositories were exfiltrated. The Canadian Centre for Cyber Security states the 3,800 figure as fact. We treat it as an attacker claim that GitHub does not contradict.

GitHub also says some internal repositories hold customer information, such as support excerpts, and that it has no evidence of impact outside them. Its 26 May update said the investigation was still ongoing. The sources also differ on dates and versions.

Why does extension auto-update matter on developer machines?

CISA says the malicious build was distributed through VS Code’s automatic update mechanism. The marketplace counts were low: 28 installs on the Marketplace and 41 Open VSX downloads from 21 IPs. Nx’s own telemetry counted about 6,000 activations, which Nx says are activations, not installs.

Nx says that before the incident any core contributor could publish a release without a second person’s approval. It added a two-admin approval rule on 19 May. The Cyber Centre advises disabling IDE extension auto-updates in high-security environments and enforcing an approved allowlist of developer tools. The question for a CISO is who decides what runs on a developer laptop. For another supply chain case, see our page on the tj-actions supply chain incident.

How could threat intelligence monitoring have given early warning?

Nx says the attacker was active for seven days before the publish, which leaves room for early signals. Threat intelligence monitoring can watch for an organization’s credentials and tokens appearing in leaks, for alerts on newly compromised packages and extensions (here the TanStack packages, a week before the Nx Console release), and for named campaigns such as the one CISA calls Megalodon. An alert on the TanStack packages might have prompted a token rotation. That is a possibility, not a promise of prevention. Nx also says that watching its audit log for workflow-run deletions would have caught the attack.

What should a security buyer ask about developer machines?

Nx lists required reviewers on publishing, audit log monitoring and pinned GitHub Action SHAs among its changes, and tells affected users to rotate every credential reachable from the machine. These questions come from the Nx, CISA and Cyber Centre guidance.

Related reading: the TanStack worm and CI questions and how a Trivy compromise reached LiteLLM releases.

Last checked against sources on 9 October 2026.