Nx Console Embedded Malicious Code Vulnerability

Summary

Nx Console contains an embedded malicious code vulnerability that allowed a malicious version of Nx Console to be published. The compromised extension fetched an obfuscated payload that could harvested credentials from multiple sources on disk and in memory.

Remediation

1. Inventory every Nx Nx Console deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.
3. Review logs from before the change for signs of exploitation.

References

• Advisoryhttps://github.com/nrwl/nx-console/security/advisories/GHSA-c9j4-9m59-847w
• Advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2026-48027
• Referencehttps://github.com/nrwl/nx-console/issues/3139
• Referencehttps://nx.dev/blog/nx-console-v18-95-0-postmortem#indicators-of-compromise
• Referencehttps://www.stepsecurity.io/blog/nx-console-vs-code-extension-compromised
• Referencehttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48027