Nx Console VS Code Extension Backdoored (v18.95.0) — TeamPCP Mini Shai-Hulud Pivot from TanStack npm Worm to GitHub Internal Repository Breach (CVE-2026-48027)

Nx Console VS Code Extension Backdoored (v18.95.0) (TL-2026-0547), also tracked as Mini Shai-Hulud, is a critical-severity supply-chain compromise scored CVSS 9.8, first published 2026-05-21. It is attributed to TeamPCP with high confidence, affects Nrwl (Nx) Nx Console VS Code Extension (nrwl.angular-console), references 2 CVEs (CVE-2026-48027, CVE-2026-45321), maps to 36 MITRE ATT&CK techniques (T1003.007, T1005, T1027), and is covered by 9 detection rules and 31 indicators of compromise.

Key facts for TL-2026-0547

Threat ID
TL-2026-0547
Also known as
Mini Shai-Hulud, Nx Console 18.95.0 incident, GHSA-c9j4-9m59-847w, Shai-Hulud: Here We Go Again
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Status
ACTIVE
Category
SUPPLY_CHAIN
First published
2026-05-21
Last reviewed
2026-05-21
Attribution
TeamPCP
Attribution confidence
HIGH
Motivation
FINANCIAL
Target sectors
technology, software-development, open-source, cloud-services, ai-research, devtools, observability
Target regions
Global, North America, Europe, Asia-Pacific
Detection rules
9
Indicators of compromise
31

Malware and tooling in Nx Console VS Code Extension Backdoored (v18.95.0)

Malware and tooling: Mini Shai-Hulud, Mini Shai-Hulud worm framework (TeamPCP custom)

TeamPCP published a malicious build of the Nx Console VS Code extension (nrwl.angular-console) v18.95.0 to the Microsoft Marketplace and Open VSX on 2026-05-18, fetching a 498 KB obfuscated payload from an orphan commit (558b09d7) on the legitimate nrwl/nx GitHub repository. The payload harvested HashiCorp Vault tokens, AWS/GCP/Azure credentials, Kubernetes service accounts, npm OIDC tokens, GitHub PATs/OAuth/app tokens, 1Password vault items, Docker credentials, and Claude Code settings, exfiltrating over HTTPS, GitHub API dead-drops, and DNS tunneling, and persisting via a macOS LaunchAgent + Python backdoor with sudoers injection on Linux. Initial access was the Mini Shai-Hulud worm compromise of 42 @tanstack/* npm packages (CVE-2026-45321) on 2026-05-11, which stole an Nx Console maintainer's gh CLI credentials and let the attacker run workflows on nrwl/nx — downstream impact includes exfiltration of ~3,800 internal GitHub corporate repositories and the Grafana Labs codebase theft (ransom declined).

How Nx Console VS Code Extension Backdoored (v18.95.0) works

On 2026-05-18, threat group TeamPCP published a backdoored version (18.95.0) of the Nx Console VS Code extension (extension ID nrwl.angular-console, 2.2M installs) simultaneously to the Microsoft Visual Studio Marketplace (live 12:30-12:48 UTC, ~18 minutes) and Open VSX Registry (live 12:33-13:09 UTC, ~36 minutes). Although the marketplaces reported only 28 and 41 official downloads, the Nx team's internal activation telemetry recorded approximately 6,000 extension activations of v18.95.0 — two orders of magnitude higher than the official figures.

Initial Access Chain — TanStack Pivot. The pivot originated in the Mini Shai-Hulud worm compromise of the @tanstack/* npm package family on 2026-05-11 (CVE-2026-45321). The attacker forked TanStack/router, opened a pull request that triggered the pull_request_target workflow, poisoned the GitHub Actions cache with a malicious pnpm store, and used attacker-controlled binaries to read the GitHub Actions runner's OIDC token directly from /proc/<pid>/mem. Because publication came from TanStack's legitimate, OIDC-trusted release pipeline, no credentials were ever stolen at the registry layer — 84 malicious package artifacts spanning 42 @tanstack/* packages (including @tanstack/react-router 1.169.5 and 1.169.8, with >12M weekly downloads) were published as-if-legitimate. A developer on the Nx Console team installed a poisoned @tanstack/* dependency on their workstation. The worm's gh-token-monitor daemon harvested their gh CLI tokens and exfiltrated them via GitHub-API dead-drops; the attacker then used those tokens to act as a contributor on nrwl/nx, push an orphan commit, and trigger the publish workflow for the malicious extension build.

Nx Console Payload — Stage 1 (Loader). Inside v18.95.0, the extension's activation handler executed npx -y github:nrwl/nx#558b09d7, fetching commit 558b09d7ad0d1660e2a0fb8a06da81a6f42e06d2 — a dangling orphan commit hidden inside the legitimate nrwl/nx repository whose tree contained a 498 KB obfuscated JavaScript payload (SHA-256 e7347d90653efc565f03733a95e9209d78f9cfa81e31ff2b2dd9d48d75a4b8b1). The malicious VSIX bundle itself is SHA-256 1a4afce34918bdc74ae3f31edaffffaa0ee074d83618f53edfd88137927340b8. Hosting the payload inside the legitimate repository's git object database (rather than on attacker infrastructure) was a deliberate evasion choice — outbound traffic to github.com is rarely blocked or inspected in developer environments, and the orphan commit is not reachable from any branch or tag.

Nx Console Payload — Stage 2 (Credential Harvest). The deobfuscated payload performs targeted credential harvesting: - GitHub: scans environment, ~/.config/gh/, ~/.git-credentials, ~/.netrc, and the macOS/Linux keyring for tokens matching the patterns ghp_, gho_, ghu_, ghs_, ghr_, and GitHub App JWTs. - npm: locates ~/.npmrc and ~/.config/npm/, and additionally calls the npm OIDC token exchange endpoint /-/npm/v1/oidc/token/exchange/package/ where it can re-mint publish tokens. - AWS: queries the IMDSv2 endpoint 169.254.169.254 and the ECS task metadata endpoint 169.254.170.2; falls back to ~/.aws/credentials and AWS_* environment variables. - GCP: scans ~/.config/gcloud/ and metadata.google.internal. - HashiCorp Vault: reads ~/.vault-token and probes loopback:8200; if a usable token is found, enumerates secret engines. - Kubernetes: reads ~/.kube/config and /var/run/secrets/kubernetes.io/serviceaccount/token. - 1Password: invokes the op CLI session if present; enumerates vaults and exports items. - Docker: reads ~/.docker/config.json. - Claude Code: reads ~/.claude/settings.json (the targeting of agentic-IDE secrets is a notable new tradecraft pattern).

Nx Console Payload — Stage 3 (Persistence and Backdoor). The payload drops a Python second-stage backdoor at ~/.local/share/kitty/cat.py and, on macOS, installs a hourly LaunchAgent at ~/Library/LaunchAgents/com.user.kitty-monitor.plist. The backdoor polls a GitHub-search dead-drop — api.github.com/search/commits?q=firedalazer — and accepts task commands authenticated by a 4096-bit RSA signature held by the operator (preventing other researchers who find the dead-drop from issuing commands). Anti-replay state is kept in /var/tmp/.gh_update_state, and ephemeral artifacts are dropped under /tmp/kitty-*. On Linux systems, if the current user already has passwordless sudo, the payload injects an additional sudoers entry granting the attacker's persistence script root execution — it never tries to escalate from a non-sudo user.

Nx Console Payload — Stage 4 (Exfiltration). Three redundant channels run in parallel: (1) HTTPS POST to an obfuscated C2 over port 443 (carrying chunked, AES-encrypted credential bundles); (2) GitHub API — using stolen GitHub tokens, the implant creates commits, gists, or repository descriptions containing exfiltrated data ('Shai-Hulud: Here We Go Again' is a known marker description used by the TanStack worm variant); (3) DNS tunneling — encrypted credential chunks are base32-encoded into subdomain labels of attacker-controlled zones, surviving most egress restrictions.

Downstream Impact. TeamPCP used credentials harvested from Nx Console victims to pivot into developer CI/CD pipelines and clone approximately 3,800 GitHub corporate-internal repositories belonging to GitHub itself. Grafana Labs detected related malicious activity on 2026-05-11 and confirmed source code theft from their GitHub environment; the group received a ransom demand from TeamPCP and refused to pay. Mistral AI and OpenAI are publicly confirmed victims of the upstream TanStack worm; the Nx Console downstream blast radius for the ~6,000 activating workstations remains under investigation.

Attribution. Wiz, StepSecurity, Ox Security, and Help Net Security assess with high confidence that TeamPCP is responsible. The group has been operationally tied to the Mini Shai-Hulud worm and to earlier supply-chain compromises against Aqua Security's Trivy scanner (March 2026), the Bitwarden CLI npm package (April 2026), and to earlier intrusions into SAP and Checkmarx infrastructure. Motivation is mixed: ransomware-style demands (Grafana) alongside source code disclosure and 'demonstration' posturing on threat-actor channels, consistent with a financially-motivated crew that also pursues notoriety and access-for-sale outcomes. Nation-state sponsorship is not assessed.

MITRE ATT&CK techniques used in TL-2026-0547

Credential Access

T1003.007 OS Credential Dumping: Proc Filesystem; T1528 Steal Application Access Token; T1552.001 Unsecured Credentials: Credentials In Files; T1552.005 Unsecured Credentials: Cloud Instance Metadata API; T1555.005 Credentials from Password Stores: Password Managers

Collection

T1005 Data from Local System; T1213.003 Data from Information Repositories: Code Repositories

Defense Evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1564.001 Hide Artifacts: Hidden Files and Directories

Exfiltration

T1041 Exfiltration Over C2 Channel; T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol; T1567.001 Exfiltration Over Web Service: Exfiltration to Code Repository

Execution

T1059.004 Command and Scripting Interpreter: Unix Shell; T1059.006 Command and Scripting Interpreter: Python; T1059.007 Command and Scripting Interpreter: JavaScript

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1071.004 Application Layer Protocol: DNS; T1102.001 Web Service: Dead Drop Resolver; T1102.002 Web Service: Bidirectional Communication; T1573.002 Encrypted Channel: Asymmetric Cryptography

Initial Access

T1078 Valid Accounts; T1199 Trusted Relationship

Lateral Movement

T1080 Taint Shared Content

Discovery

T1083 File and Directory Discovery; T1526 Cloud Service Discovery; T1613 Container and Resource Discovery

initial-access

T1195 Supply Chain Compromise; T1195.002 Compromise Software Supply Chain

Impact

T1485 Data Destruction

Persistence

T1543.001 Create or Modify System Process: Launch Agent; T1543.002 Create or Modify System Process: Systemd Service

privilege-escalation

T1548.003 Abuse Elevation Control Mechanism: Sudo and Sudo Caching

Resource Development

T1583.001 Acquire Infrastructure: Domains; T1587.001 Develop Capabilities: Malware

Affected products and versions in Nx Console VS Code Extension Backdoored (v18.95.0)

  • Nrwl (Nx) — Nx Console VS Code Extension (nrwl.angular-console)
    Vulnerable versions: 18.95.0
    Fixed in: 18.100.0
  • TanStack — @tanstack/react-router
    Vulnerable versions: 1.169.5; 1.169.8
    Fixed in: 1.169.9+
  • TanStack — @tanstack/router-core
    Vulnerable versions: 1.169.5; 1.169.8
    Fixed in: 1.169.9+
  • TanStack — @tanstack/solid-router
    Vulnerable versions: 1.169.5; 1.169.8
    Fixed in: 1.169.9+
  • TanStack — @tanstack/vue-router
    Vulnerable versions: 1.169.5; 1.169.8
    Fixed in: 1.169.9+
  • Microsoft — Visual Studio Marketplace (distribution channel)
    Vulnerable versions: malicious nrwl.angular-console listing 12:30-12:48 UTC 2026-05-18
    Fixed in: delisted
  • Eclipse Foundation — Open VSX Registry (distribution channel)
    Vulnerable versions: malicious nrwl.angular-console listing 12:33-13:09 UTC 2026-05-18
    Fixed in: delisted

Remediation for Nx Console VS Code Extension Backdoored (v18.95.0)

Patches

  • Upgrade nrwl.angular-console (Nx Console) to v18.100.0 or later
  • For TanStack consumers: pin @tanstack/* to known-good versions and use the Snyk/Socket/Aikido published cleanlists; rebuild and republish anything that ingested 1.169.5 or 1.169.8 during the worm window
  • Apply GitHub's recommended pull_request_target hardening — require explicit collaborator approval for fork PR workflow execution and disable cache write from untrusted contexts

Immediate actions

  • Identify all developer workstations that had nrwl.angular-console v18.95.0 installed between 2026-05-18 12:30 UTC and 13:09 UTC — check VS Code activation telemetry and code --list-extensions --show-versions output history
  • Before revoking any credentials, locate and remove the persistence daemons — ~/.local/share/kitty/cat.py, ~/Library/LaunchAgents/com.user.kitty-monitor.plist, ~/Library/LaunchAgents/com.user.gh-token-monitor.plist, ~/.config/systemd/user/gh-token-monitor.service — because the TanStack-variant daemon triggers rm -rf ~/ on token revocation
  • Delete anti-replay state files /var/tmp/.gh_update_state and any /tmp/kitty-* artifacts; on Linux, audit /etc/sudoers and /etc/sudoers.d/ for attacker-injected NOPASSWD entries
  • Rotate every credential class the payload targets: GitHub PAT/OAuth/App tokens, npm tokens (including OIDC-derived publish tokens), AWS keys + role STS, GCP service account keys, Azure tokens, Vault tokens (and re-key the secrets they unsealed), Kubernetes service account tokens, 1Password session tokens (and force re-auth on all developer machines), Docker registry creds, Claude Code API keys
  • Audit GitHub for unexpected commits, gists, and repository description changes containing the marker string 'Shai-Hulud: Here We Go Again' — these are the GitHub-API exfil dead-drops
  • Block egress to git-tanstack.com and IP 83.142.209.194 at perimeter
  • Force-reinstall Nx Console to v18.100.0 (or later) on all developer workstations

Workarounds

  • Uninstall Nx Console entirely until v18.100.0 can be verified, or pin to v18.94.x explicitly
  • Disable VS Code extension auto-update across the developer fleet (settings.json: 'extensions.autoUpdate': false) and require centrally-approved updates
  • Remove the gh CLI default credential helper on developer workstations and use SSH or short-lived OIDC instead — this directly breaks the TanStack-variant token-monitor harvest path

Longer-term hardening

  • Treat IDE extension marketplaces (VS Marketplace, Open VSX) as a tier-1 supply chain risk — require allowlisting, signature verification, and version pinning per workstation policy
  • Centralize developer credentials in short-lived, OIDC-issued or hardware-bound tokens — eliminate long-lived PATs and npmrc tokens on workstations
  • Move npm/GitHub publishing to OIDC + provenance attestations with separate signing identity (Sigstore-backed), and require human approval for any publish that originates from a forked PR or pull_request_target workflow
  • Deploy EDR with detection content for LaunchAgent and systemd user-unit creation by IDE/Node processes (T1543.001/T1543.002 from a JavaScript runtime is high-fidelity)
  • Mandate egress restriction on developer workstations — no DNS to arbitrary domains, no outbound to non-allowlisted IPs — to break the DNS-tunneling and obfuscated-C2 exfil channels
  • Network-isolate IMDS (169.254.169.254) and ECS metadata (169.254.170.2) endpoints from developer workstations and CI runners that have no business reaching them
  • Adopt agent-IDE secrets scanning — ~/.claude/settings.json, MCP server tokens, and similar configs must be encrypted-at-rest and excluded from broad-scope process reads

CVEs associated with Nx Console VS Code Extension Backdoored (v18.95.0)

CVE-2026-48027, CVE-2026-45321

Weaknesses (CWE) in Nx Console VS Code Extension Backdoored (v18.95.0)

CWE-506, CWE-829, CWE-522, CWE-732, CWE-94, CWE-1357

Timeline of Nx Console VS Code Extension Backdoored (v18.95.0)

  • TeamPCP compromises Aqua Security's Trivy scanner via supply-chain injection — establishes the operator's recurring pattern of attacking devtools the security industry itself relies on.
  • TeamPCP compromises the Bitwarden CLI npm package — first public appearance of the gh-token-monitor daemon pattern that will later be reused in Mini Shai-Hulud.
  • Grafana Labs detects malicious activity in its GitHub environment originating from a developer workstation that consumed a poisoned @tanstack/* dependency; source-code theft is later confirmed.
  • Mini Shai-Hulud worm compromises 84 malicious artifacts across 42 @tanstack/* npm packages (versions 1.169.5 and 1.169.8 of @tanstack/react-router, router-core, solid-router, vue-router, and ~38 others) via a pull_request_target abuse on TanStack/router; OIDC token is read from /proc/<pid>/mem and used to publish through TanStack's legitimate release pipeline. CVE-2026-45321 assigned.
  • An Nx Console maintainer's gh CLI tokens are harvested by the TanStack-variant gh-token-monitor daemon installed via a poisoned @tanstack/* dev dependency; tokens are exfiltrated via GitHub-API dead-drop.
  • Wiz, Snyk, Socket, Aikido, and Orca publish initial analyses of the TanStack compromise; the worm is identified as a Mini Shai-Hulud variant attributed to TeamPCP.
  • OpenAI publishes its response to the TanStack npm supply chain attack, confirming exposure across internal projects that depended on @tanstack/* packages.
  • Nx publishes GHSA-c9j4-9m59-847w, releases fixed v18.100.0, and discloses the TanStack-origin developer compromise as root cause; CVE-2026-48027 is assigned.
  • Microsoft Marketplace delists v18.95.0 at 12:48 UTC (18-minute exposure window); Open VSX delists at 13:09 UTC (36-minute exposure window). Internal activation telemetry records ~6,000 v18.95.0 activations, ~2 orders of magnitude higher than the official marketplace download counts.
  • At 12:30 UTC, TeamPCP publishes nrwl.angular-console v18.95.0 to the Microsoft Visual Studio Marketplace; at 12:33 UTC, the same malicious build is published to Open VSX. Both listings reference an orphan commit 558b09d7ad0d1660e2a0fb8a06da81a6f42e06d2 inside the legitimate nrwl/nx repository.
  • StepSecurity, The Hacker News, and Ox Security publish payload analyses: 498 KB obfuscated JS, Python backdoor at ~/.local/share/kitty/cat.py, LaunchAgent persistence, RSA-signed dead-drop commands via api.github.com/search/commits?q=firedalazer.
  • Public reporting confirms ~3,800 GitHub internal corporate repositories have been exfiltrated; Mistral AI and OpenAI are publicly confirmed downstream victims of the upstream TanStack worm.
  • Help Net Security and BleepingComputer publish the consolidated root-cause analysis explicitly linking GitHub's internal repo breach and Grafana Labs' codebase theft back to TanStack via the Nx Console pivot; Grafana confirms it declined the ransom demand.
  • As of 2026-05-29, this remains ACTIVE: CISA added both CVE-2026-48027 (Nx Console) and CVE-2026-45321 (TanStack) to its KEV catalog on 2026-05-27 as confirmed actively-exploited, due 2026-06-10. TeamPCP is undeterred—no arrest/takedown—running concurrent Megalodon (5,561 repos) and durabletask PyPI worm campaigns through the revalidation window.

Sources cited for Nx Console VS Code Extension Backdoored (v18.95.0)

Threats related to Nx Console VS Code Extension Backdoored (v18.95.0)

Detection coverage for TL-2026-0547

As of 2026-05-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0547 across Splunk SPL, Microsoft KQL and Sigma, covering 31 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats