Malware in the Nx Console extension (CVE-2026-48027) — a supply-chain attack that steals developer credentials

1Nx as a build and task runner

CVE-2026-48027 covers a case where a version of "Nx Console" — the IDE extension for Nx (a monorepo build/task runner) — was published with malicious code embedded. It was added to CISA's KEV (Known Exploited Vulnerabilities) catalog on May 27, 2026 and is classified as CWE-506 (embedded malicious code).

2How the tampered extension attack unfolds

The attack flow: installing the tampered extension downloads and executes an obfuscated payload from an external source, then harvests every credential it can find on disk or in memory. The targets are the "keys" developers handle daily — GitHub and npm access tokens, SSH private keys, cloud (e.g. AWS) credentials. Once stolen, an attacker can impersonate a legitimate developer and reach source code, CI/CD, and production.

3When a trusted distribution channel is abused

This class of attack is dangerous because (1) it abuses the trusted distribution channel of a tool developers rely on (an extension marketplace or npm), so it is hard to notice, and (2) compromising a single developer's machine can become a foothold that spreads across the whole organization. CISA has also confirmed exploitation in ransomware campaigns, so priority is high.

4The tools of development as the target

This case is not an attack exploiting a vulnerability but the class where malicious code is embedded in what is distributed. Such records are few, as are development-platform vendors.

Installing the tampered extension downloads and runs an obfuscated payload from outside and harvests credentials present on disk and in memory. What is targeted are the keys developers handle daily: GitHub and npm access tokens, SSH private keys, cloud credentials. Revoking and reissuing every token, key and password that may have been used on the affected machine is recommended.