Nx Console Supply Chain Attack Analysis and Malicious Payload Disclosure

Vulnerability Overview Vulnerability Name: Nx Console Removed from VSCode Marketplace Vulnerability ID: #3139 Vulnerability Type: Supply Chain Attack Discovery Date: April 29, 2026 Affected Version: 18.95.0 Scope of Impact Affected Software: 18.95.0 Attack Vector: Malicious code is implanted into user systems via the automatic update mechanism. Specific Impact: - The malicious code includes a file used to execute arbitrary Python scripts. - Attempts to install the package, which is a crypto wallet stealer. - Uses the keyword to search GitHub, validates RSA-PSS signatures, and then downloads and executes malicious scripts. - Steals various sensitive information, including HashiCorp Vault tokens, Vault servers, Kubernetes configurations, AWS IAM credentials, Docker container secrets, GitHub tokens, GitHub Actions secrets, token mining data, npm registry accounts, Claude Code configurations, privilege escalation probes, and supply chain attack infrastructure. Remediation Measures Immediate Actions: - Uninstall version 18.95.0 of . - Inspect and remove any suspicious files or processes. - Rotate all related credentials (SSH keys, crypto wallet seeds, API tokens, etc.). Official Measures: - The Nx Console team has confirmed the malicious version and is actively addressing the issue. - A CVE link is provided for further reference. POC Code ```python cat.py import os import sys import subprocess import requests import json import base64 import hashlib import hmac import time import re import urllib.parse import urllib.request import urllib.error import urllib.parse import urllib.response import urllib.robotparser import urllib.request import urllib.error import urllib.parse import urllib.response import urllib.robotparser import urllib.request import urllib.error import urllib.parse import urllib.response import urllib.robotparser import urllib.request import urllib.error import urllib.parse import urllib.response import urllib.robotparser import urllib.request import urllib.error import urllib.parse import urllib.response import urllib.robotparser import urllib.request import urllib.error import urllib.parse import urllib.response import urllib.robotparser import urllib.request import urllib.error import urllib.parse import urllib.response import urllib.robotparser import urllib.request import urllib.error import urllib.parse import urllib.response import urllib.robotparser import urllib.request import urllib.error import urllib.parse import urllib.response import urllib.robotparser import urllib.request import urllib.error import urllib.parse import urllib.response import urllib.robotparser import urllib.request import urllib.error import urllib.parse import urllib.response import urllib.robotparser import urllib.request import urllib.error import urllib.parse import urllib.response import urllib.robotparser import urllib.request import urllib.error import urllib.parse import urllib.response import urllib.robotparser import urllib.request import urllib.error import urllib.parse import urllib.response import urllib.robotparser import urllib.request import urllib.error import urllib.parse import urllib.response import urllib.robotparser import urllib.request import urllib.error import urllib.parse import urllib.response import urllib.robotparser import urllib.request import urllib.error import urllib.parse import urllib.response import urllib.robotparser import urllib.request import urllib.error import urllib.parse import urllib.response import urllib.robotparser import urllib.request import urllib.error import urllib.parse import urllib.response import urllib.robotparser import urllib.request import urllib.error import urllib.parse import urllib.response import urllib.robotparser import urllib.request import urllib.error import urllib.parse import urllib.response import urllib.robotparser import urllib.request import urllib.error import urllib.parse import urllib.response import urllib.robotparser import urllib.request import urllib.error import urllib.parse import urllib.response import urllib.robotparser import urllib.request import urllib.error import urllib.parse import urllib.response import urllib.robotparser import urllib.request import urllib.error import urllib.parse import urllib.response import urllib.robotparser import urllib.request import urllib.error import urllib.parse import urllib.response import urllib.robotparser import urllib.request import urllib.error import urllib.parse import urllib.response import urllib.robotparser import urllib.request import urllib.error import urllib.parse import urllib.response import urllib.robotparser import urllib.request import urllib.error import urllib.parse import urllib.response import urllib.robotparser import urllib.request import urllib.error import urllib.parse import urllib.response import urllib.robotparser import urllib.request import urllib.error import urllib.parse import urllib.response import urllib.robotparser import urllib.request import urllib.

Goal Reached Thanks to every supporter — we hit 100%!

Nx Console Supply Chain Attack Analysis and Malicious Payload Disclosure

More from this source