Article
Nx Console and GitHub: dev tools as an entry path
How a token stolen on 11 May 2026 led from a developer machine to a poisoned Nx Console extension and GitHub's internal repositories, and…
Read more
Exploited vulnerability
Nx Console poisoned release (CVE-2026-48027)
CVE-2026-48027
CVE-2026-48027 is not a coding bug in Nx Console.
- On CISA KEV
- CVE ID
- CVE-2026-48027
- CISA KEV
- Listed
- Affected product
- Nx Console (extension for Visual Studio Code)
- Exploited
- Yes
- Published
- May 2026
In short
CVE-2026-48027 is not a coding bug in Nx Console. It is the number given to one poisoned release, version 18.95.0 of the Nx Console extension for Visual Studio Code, which was online for under an hour in May 2026 and stole credentials from machines that ran it. CISA lists it as an exploited embedded malicious code issue.
- CVECVE-2026-48027
- ProductNx Nx Console (extension for Visual Studio Code)
- CISA KEVListedKnown Exploited Vulnerabilities
- ExploitedYesin real attacks
- Fix Steps5actions listedRemove 18.95.0 and update · Clean affected machines
What it allows
When the poisoned extension started, it fetched a hidden payload that searched the machine, and its memory, for credentials. The vendor lists Vault, npm, AWS, GitHub, 1Password, SSH, Google Cloud and Docker secrets. The data left by HTTPS, the GitHub API and DNS. NVD scores it 9.8 (CVSS v3.1, NVD as primary scorer). GitHub, which assigned the record, scores it 9.3 (CVSS v4.0). Treat any machine that ran it as fully exposed.
Who is affected
Per the vendor advisory, only Nx Console 18.95.0 for Visual Studio Code is affected, and the fixed version is 18.100.0. The vendor says its own usage data points to thousands of affected users, although the two extension stores counted only 28 and 41 downloads. CISA says the build spread through the editor's automatic update, so nobody had to install it by hand.
The vendor's postmortem puts the exposure window on 18 May 2026, 12:30 to 13:09 UTC. NVD gives 19 May for the same upload, so sources differ on the day. The vendor advisory says the Visual Studio Marketplace copy stayed up about 18 minutes and the Open VSX copy about 36 minutes. First exploitation, as the vendor states it: 18 May 2026.
The vendor says one of its developers had been compromised through the TanStack npm incident, which leaked a GitHub token through the GitHub command line tool. CISA says threat actors used a prior compromise of Nx developer systems to reach a GitHub employee's device through the poisoned extension and take internal GitHub repositories. GitHub says it detected and contained this on 18 May 2026.
NVD published the record on 27 May 2026. CISA added it to its Known Exploited Vulnerabilities (KEV) catalog on 27 May 2026 with a due date of 10 June 2026, and published an alert on 28 May 2026. The KEV entry flags known ransomware campaign use as Known. The sources opened here describe no ransomware group or ransomware attack tied to this release. No official source opened here names an actor for the Nx Console release, so there is no attribution.
Seen in
- Incident Nx Console extension and GitHub repositories breach On 18 May 2026 an attacker published a malicious version 18.95.0 of the Nx Console extension for VS Code, using a real Nx contributor's identity. May 2026 · Technology and software supply chain
- Incident TanStack npm worm (Mini Shai-Hulud) The TanStack npm worm, also called Mini Shai-Hulud, was a supply chain attack. May 2026 · Technology and software supply chain
What to do
-
Remove 18.95.0 and update
Update Nx Console to 18.100.0 or later, as the vendor says. Make sure the malicious version is no longer running, because it starts the rest of the chain.
-
Clean affected machines
Kill any process running cat.py or carrying __DAEMONIZED=1 in its environment, then delete the files the vendor lists. On macOS, unload the launch agent before deleting it.
-
Rotate every reachable secret
The vendor says to rotate every credential reachable from the machine. CISA adds all secrets reachable by CI/CD pipelines. The Canadian Cyber Centre advises rotating credentials exposed on developer machines between 11 and 20 May 2026.
-
Control extension updates
The Canadian Cyber Centre advises turning off IDE extension auto-update in high-security settings and keeping an approved allowlist. CISA advises waiting at least three hours before pulling a new package and pinning versions.
-
Detect and hunt
Check for Nx Console 18.95.0 installed on 18 May 2026 and for ~/.local/share/kitty/cat.py, a kitty-monitor launch agent and /var/tmp/.gh_update_state. Review workflow files and commits by automated accounts after 18 May 2026, as CISA asks.
Questions
What is CVE-2026-48027?
It is the number for a poisoned release of the Nx Console extension for Visual Studio Code, version 18.95.0, which carried embedded malicious code (CWE-506). It was published in May 2026 using a real Nx contributor's identity.
Which Nx Console version is affected and which is fixed?
Per the vendor advisory, only Nx Console 18.95.0 for Visual Studio Code is affected. The fixed version is 18.100.0, so anyone who ran 18.95.0 should update and treat the machine as fully exposed.
What does the poisoned Nx Console extension do?
When it started, it fetched a hidden payload that searched the machine and its memory for credentials, including Vault, npm, AWS, GitHub, 1Password, SSH, Google Cloud and Docker secrets. The data left by HTTPS, the GitHub API and DNS.
How did the bad Nx Console release spread?
CISA says the build spread through the editor's automatic update, so nobody had to install it by hand. The vendor puts the exposure window on 18 May 2026, about 18 minutes on one store and about 36 minutes on the other.
Is CVE-2026-48027 exploited in the wild?
Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 27 May 2026 with a due date of 10 June 2026. No official source opened for this page names an actor for the release.
In our research
- Nx Console and GitHub: dev tools as an entry path October 2026
Sources
- Compromised Nx Console version 18.95.0 (GHSA-c9j4-9m59-847w) Nx, via GitHub Advisory Database
- Postmortem: Nx Console v18.95.0 supply-chain compromise Nx
- CVE-2026-48027 record NIST NVD
- Known Exploited Vulnerabilities catalog CISA
- Supply Chain Compromises Impact Nx Console and GitHub Repositories CISA
- Investigating unauthorized access to GitHub-owned repositories GitHub
- Security incident impacting GitHub internal repositories (AL26-013) Canadian Centre for Cyber Security
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.