Nx Console v18.95.0 Supply Chain Attack: Malware Analysis & Mitigation

Vulnerability Overview Vulnerability Name: Nx Console v18.95.0 Supply Chain Attack Discovery Date: 2026-05-18 Description: Between 12:30 and 13:09 UTC on 2026-05-18, attackers published malicious versions of Nx Console v18.95.0 to the Visual Studio Marketplace and Open VSX registry. This malicious version was obtained via the TanStack supply chain attack, leveraging the GitHub OAuth tokens of contributors. Affected Scope Affected Version: Nx Console v18.95.0 Unaffected Versions: v18.100.5 and later Installation Counts: - Visual Studio Marketplace: 28 installations - Open VSX: 41 downloads (from 21 unique IPs) - Nx Internal Activation Count: ~6,000 activations (non-installation based) Remediation Fixed Version: v18.100.5 and later Recommended Actions: - Any users who installed v18.95.0 between 12:30 and 13:09 UTC on 2026-05-18 should consider their machines compromised and rotate credentials. - Patch the release pipeline vulnerabilities and extend fixes to other publishable repositories. - Users with automatic updates enabled for Nx Console should assume their machines are compromised. Malicious Behavior Persistence: - macOS/Linux: Writes to (Python backdoor), (persistence on reboot), (staging), (state) - Linux: Modifies for privilege persistence - Windows: Writes to (Python backdoor), (staging), (state), (persistence) Credential Theft: - Vault: , , Kubernetes service account tokens, AWS IAM authentication tokens - npm: tokens, OIDC token exchange - AWS: IMDS/ECS metadata services, Secrets Manager, SSM Parameter Store, Web Identity tokens - GitHub: Steals , , tokens from , , environment variables, and process memory - 1Password: Steals contents if the CLI session is active at runtime - Filesystem: SSH private keys, files, GCP Application Default Credentials, Docker configuration Data Exfiltration: - Exfiltrates data via HTTPS to attacker infrastructure, GitHub API, and DNS-based covert channels Timeline 2026-05-11 19:20-19:26: Attacker published 84 malicious versions across 42 npm packages 2026-05-11 20:43:01: An Nx contributor ran in an external repository, triggering the malware's script 2026-05-11 20:43:51: Attacker pushed the first malicious commit 2026-05-11 20:44:15-20:45:56: First cleanup of tampered GitHub workflows 2026-05-11 21:34, 21:36: Malware re-executed locally, followed by a second workflow deletion cleanup 2026-05-12 00:12:49: Publication of , disclosing the TanStack vulnerability 2026-05-15 23:56:05: Attacker returned, using the same token 2026-05-16 00:04:07: Last use of the stolen token in audit logs Root Cause 1. TanStack Supply Chain Attack: The attacker exploited vulnerabilities in TanStack's release pipeline to publish malicious versions 2. Configuration Issue: The project was configured with (7 days), but the field pointed to npm 10.14, which does not support this configuration 3. CLI Credentials Retrieveable: The attacker retrieved CLI credentials from local processes 4. Nx Console Release Pipeline Allows Single-Actor Publishing: The release pipeline lacked reviewer rules, gates, or checks to ensure the published version matched the release decision Code Snippet Summary The Nx Console v18.95.0 version is vulnerable to a supply chain attack. The attacker obtained contributors' GitHub OAuth tokens via the TanStack supply chain attack to publish a malicious version. Affected users should immediately update to v18.100.5 or later and rotate all related credentials.

Goal Reached Thanks to every supporter — we hit 100%!

Nx Console v18.95.0 Supply Chain Attack: Malware Analysis & Mitigation