Malware in the Nx Console extension (CVE-2026-48027) — a supply-chain attack that steals developer credentials

CVE-2026-48027 covers a case where a version of "Nx Console" — the IDE extension for Nx (a monorepo build/task runner) — was published with malicious code embedded. It was added to CISA's KEV (Known Exploited Vulnerabilities) catalog on May 27, 2026 and is classified as CWE-506 (embedded malicious code).

The attack flow: installing the tampered extension downloads and executes an obfuscated payload from an external source, then harvests every credential it can find on disk or in memory. The targets are the "keys" developers handle daily — GitHub and npm access tokens, SSH private keys, cloud (e.g. AWS) credentials. Once stolen, an attacker can impersonate a legitimate developer and reach source code, CI/CD, and production.

This class of attack is dangerous because (1) it abuses the trusted distribution channel of a tool developers rely on (an extension marketplace or npm), so it is hard to notice, and (2) compromising a single developer's machine can become a foothold that spreads across the whole organization. CISA has also confirmed exploitation in ransomware campaigns, so priority is high.

Key response: if you use Nx Console, check the vendor's official GitHub Security Advisory, identify affected versions, and update to a known-good version (or uninstall for now). Then revoke and reissue (rotate) every token, key, and password that may have been used on that machine, and review CI/CD and cloud access logs for suspicious use. U.S. federal civilian agencies were required to remediate by June 10, 2026 (a practical benchmark for others, too).