Nx Console VS Code Extension Supply Chain Compromise and Malicious Code Injection (CVE-2026-48027)

1. Verify and Uninstall Compromised Version

Check the installed version of Nx Console in your VS Code extensions list. If version 18.95.0 is detected, uninstall it immediately.

2. Upgrade to Safe Version

Force-update the extension to the remediated version 18.100.0 or later.

# Force reinstall and upgrade the extension via VS Code CLI
code --uninstall-extension nrwl.angular-console
code --install-extension nrwl.angular-console@18.100.0

3. Incident Response & Credential Rotation

If the compromised version was active on any developer workstation, treat the environment as compromised. Revoke and rotate all active credentials, including AWS keys, git SSH keys, and API tokens stored on the machine.

This vulnerability is a critical Supply Chain Attack resulting from the compromise of the distribution pipeline for Nx Console, the user interface for Nx & Lerna. An unauthorized malicious actor published a compromised version (18.95.0) containing malicious payloads directly to official extension registries.

Attack Mechanism & Impact

• Malicious Code Injection (CWE-506): The attacker injected malicious code into the extension package, which executes automatically upon extension activation within the IDE.
• Exposure Window: The compromised version was available for approximately 18 minutes on the VS Code Marketplace (12:30 to 12:48 UTC) and 36 minutes on OpenVSX (12:33 to 13:09 UTC).
• Severity: Because VS Code extensions run with the privileges of the local user, the injected code could access local source code, harvest sensitive environment variables (such as cloud credentials and API tokens), and establish persistent backdoors.

Due to active exploitation in the wild, this vulnerability has been added to the CISA KEV (Known Exploited Vulnerabilities) catalog and carries an extremely high EPSS score of 0.94.