# Nx Console VS Code Extension Backdoored (v18.95.0) — TeamPCP Mini Shai-Hulud Pivot from TanStack npm Worm to GitHub Internal Repository Breach (CVE-2026-48027)

> TeamPCP published a malicious build of the Nx Console VS Code extension (nrwl.angular-console) v18.95.0 to the Microsoft Marketplace and Open VSX on 2026-05-18, fetching a 498 KB obfuscated payload from an orphan commit (558b09d7) on the legitimate nrwl/nx GitHub repository. The payload harvested HashiCorp Vault tokens, AWS/GCP/Azure credentials, Kubernetes service accounts, npm OIDC tokens, GitHub PATs/OAuth/app tokens, 1Password vault items, Docker credentials, and Claude Code settings, exfiltrating over HTTPS, GitHub API dead-drops, and DNS tunneling, and persisting via a macOS LaunchAgent + Python backdoor with sudoers injection on Linux. Initial access was the Mini Shai-Hulud worm compromise of 42 @tanstack/* npm packages (CVE-2026-45321) on 2026-05-11, which stole an Nx Console maintainer's gh CLI credentials and let the attacker run workflows on nrwl/nx — downstream impact includes exfiltration of ~3,800 internal GitHub corporate repositories and the Grafana Labs codebase theft (ransom declined).

- **Published:** 2026-05-21T12:00:00Z
- **Last reviewed:** 2026-10-20T20:28:07.305Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0547
- **ID:** TL-2026-0547
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** TeamPCP
- **Detections:** 9 · **IOCs:** 41 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-48027, CVE-2026-45321

## Description

On 2026-05-18, threat group TeamPCP published a backdoored version (18.95.0) of the Nx Console VS Code extension (extension ID nrwl.angular-console, 2.2M installs) simultaneously to the Microsoft Visual Studio Marketplace (live 12:30-12:48 UTC, ~18 minutes) and Open VSX Registry (live 12:33-13:09 UTC, ~36 minutes). Although the marketplaces reported only 28 and 41 official downloads, the Nx team's internal activation telemetry recorded approximately 6,000 extension activations of v18.95.0 — two orders of magnitude higher than the official figures.

Initial Access Chain — TanStack Pivot. The pivot originated in the Mini Shai-Hulud worm compromise of the @tanstack/* npm package family on 2026-05-11 (CVE-2026-45321). The attacker forked TanStack/router, opened a pull request that triggered the pull_request_target workflow, poisoned the GitHub Actions cache with a malicious pnpm store, and used attacker-controlled binaries to read the GitHub Actions runner's OIDC token directly from /proc/<pid>/mem. Because publication came from TanStack's legitimate, OIDC-trusted release pipeline, no credentials were ever stolen at the registry layer — 84 malicious package artifacts spanning 42 @tanstack/* packages (including @tanstack/react-router 1.169.5 and 1.169.8, with >12M weekly downloads) were published as-if-legitimate. A developer on the Nx Console team installed a poisoned @tanstack/* dependency on their workstation. The worm's gh-token-monitor daemon harvested their gh CLI tokens and exfiltrated them via GitHub-API dead-drops; the attacker then used those tokens to act as a contributor on nrwl/nx, push an orphan commit, and trigger the publish workflow for the malicious extension build.

Nx Console Payload — Stage 1 (Loader). Inside v18.95.0, the extension's activation handler executed npx -y github:nrwl/nx#558b09d7, fetching commit 558b09d7ad0d1660e2a0fb8a06da81a6f42e06d2 — a dangling orphan commit hidden inside the legitimate nrwl/nx repository whose tree contained a 498 KB obfuscated JavaScript payload (SHA-256 e7347d90653efc565f03733a95e9209d78f9cfa81e31ff2b2dd9d48d75a4b8b1). The malicious VSIX bundle itself is SHA-256 1a4afce34918bdc74ae3f31edaffffaa0ee074d83618f53edfd88137927340b8. Hosting the payload inside the legitimate repository's git object database (rather than on attacker infrastructure) was a deliberate evasion choice — outbound traffic to github.com is rarely blocked or inspected in developer environments, and the orphan commit is not reachable from any branch or tag.

Nx Console Payload — Stage 2 (Credential Harvest). The deobfuscated payload performs targeted credential harvesting:
- GitHub: scans environment, ~/.config/gh/, ~/.git-credentials, ~/.netrc, and the macOS/Linux keyring for tokens matching the patterns ghp_, gho_, ghu_, ghs_, ghr_, and GitHub App JWTs.
- npm: locates ~/.npmrc and ~/.config/npm/, and additionally calls the npm OIDC token exchange endpoint /-/npm/v1/oidc/token/exchange/package/ where it can re-mint publish tokens.
- AWS: queries the IMDSv2 endpoint 169.254.169.254 and the ECS task metadata endpoint 169.254.170.2; falls back to ~/.aws/credentials and AWS_* environment variables.
- GCP: scans ~/.config/gcloud/ and metadata.google.internal.
- HashiCorp Vault: reads ~/.vault-token and probes loopback:8200; if a usable token is found, enumerates secret engines.
- Kubernetes: reads ~/.kube/config and /var/run/secrets/kubernetes.io/serviceaccount/token.
- 1Password: invokes the op CLI session if present; enumerates vaults and exports items.
- Docker: reads ~/.docker/config.json.
- Claude Code: reads ~/.claude/settings.json (the targeting of agentic-IDE secrets is a notable new tradecraft pattern).

Nx Console Payload — Stage 3 (Persistence and Backdoor). The payload drops a Python second-stage backdoor at ~/.local/share/kitty/cat.py and, on macOS, installs a hourly LaunchAgent at ~/Library/LaunchAgents/com.user.kitty-monitor.plist. The backdoor polls a GitHub-search dead-drop — api.github.com/search/commits?q=firedalazer — and accepts task commands authenticated by a 4096-bit RSA signature held by the operator (preventing other researchers who find the dead-drop from issuing commands). Anti-replay state is kept in /var/tmp/.gh_update_state, and ephemeral artifacts are dropped under /tmp/kitty-*. On Linux systems, if the current user already has passwordless sudo, the payload injects an additional sudoers entry granting the attacker's persistence script root execution — it never tries to escalate from a non-sudo user.

Nx Console Payload — Stage 4 (Exfiltration). Three redundant channels run in parallel: (1) HTTPS POST to an obfuscated C2 over port 443 (carrying chunked, AES-encrypted credential bundles); (2) GitHub API — using stolen GitHub tokens, the implant creates commits, gists, or repository descriptions containing exfiltrated data ('Shai-Hulud: Here We Go Again' is a known marker description used by the TanStack worm variant); (3) DNS tunneling — encrypted credential chunks are base32-encoded into subdomain labels of attacker-controlled zones, surviving most egress restrictions.

Downstream Impact. TeamPCP used credentials harvested from Nx Console victims to pivot into developer CI/CD pipelines and clone approximately 3,800 GitHub corporate-internal repositories belonging to GitHub itself. Grafana Labs detected related malicious activity on 2026-05-11 and confirmed source code theft from their GitHub environment; the group received a ransom demand from TeamPCP and refused to pay. Mistral AI and OpenAI are publicly confirmed victims of the upstream TanStack worm; the Nx Console downstream blast radius for the ~6,000 activating workstations remains under investigation.

Attribution. Wiz, StepSecurity, Ox Security, and Help Net Security assess with high confidence that TeamPCP is responsible. The group has been operationally tied to the Mini Shai-Hulud worm and to earlier supply-chain compromises against Aqua Security's Trivy scanner (March 2026), the Bitwarden CLI npm package (April 2026), and to earlier intrusions into SAP and Checkmarx infrastructure. Motivation is mixed: ransomware-style demands (Grafana) alongside source code disclosure and 'demonstration' posturing on threat-actor channels, consistent with a financially-motivated crew that also pursues notoriety and access-for-sale outcomes. Nation-state sponsorship is not assessed.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1195.002 Compromise Software Supply Chain
- T1587.001 Develop Capabilities: Malware
- T1583.001 Acquire Infrastructure: Domains
- T1199 Trusted Relationship
- T1078 Valid Accounts
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1059.006 Command and Scripting Interpreter: Python
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1543.001 Create or Modify System Process: Launch Agent
- T1543.002 Create or Modify System Process: Systemd Service
- T1548.003 Abuse Elevation Control Mechanism: Sudo and Sudo Caching
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1564.001 Hide Artifacts: Hidden Files and Directories
- T1036.005 Match Legitimate Resource Name or Location
- T1552.001 Unsecured Credentials: Credentials In Files
- T1552.005 Unsecured Credentials: Cloud Instance Metadata API
- T1528 Steal Application Access Token
- T1555.005 Credentials from Password Stores: Password Managers
- T1003.007 OS Credential Dumping: Proc Filesystem
- T1083 File and Directory Discovery
- T1526 Cloud Service Discovery
- T1613 Container and Resource Discovery
- T1080 Taint Shared Content
- T1005 Data from Local System
- T1213.003 Data from Information Repositories: Code Repositories
- T1071.001 Application Layer Protocol: Web Protocols
- T1071.004 Application Layer Protocol: DNS
- T1102.002 Web Service: Bidirectional Communication
- T1102.001 Web Service: Dead Drop Resolver
- T1573.002 Encrypted Channel: Asymmetric Cryptography
- T1041 Exfiltration Over C2 Channel
- T1567.001 Exfiltration Over Web Service: Exfiltration to Code Repository
- T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol
- T1485 Data Destruction
- T1078.004 Valid Accounts: Cloud Accounts
- T1497.001 Virtualization/Sandbox Evasion: System Checks
- T1614 System Location Discovery
- T1105 Ingress Tool Transfer

## Sources

- [GitHub, Grafana Labs breaches traced back to TanStack supply chain compromise](https://www.helpnetsecurity.com/2026/05/21/github-grafana-breach-root-cause-nx-console/)
- [GHSA-c9j4-9m59-847w — Compromised Nx Console version 18.95.0](https://github.com/nrwl/nx-console/security/advisories/GHSA-c9j4-9m59-847w)
- [Nx Console VS Code Extension Compromised](https://www.stepsecurity.io/blog/nx-console-vs-code-extension-compromised)
- [Mini Shai-Hulud Strikes Again: TanStack + more npm Packages Compromised](https://www.wiz.io/blog/mini-shai-hulud-strikes-again-tanstack-more-npm-packages-compromised)
- [TanStack npm Packages Hit by Mini Shai-Hulud](https://snyk.io/blog/tanstack-npm-packages-compromised/)
- [Nx Console 18.95.0 Incident: How TeamPCP Breached GitHub](https://www.ox.security/blog/teampcp-strikes-again-how-a-trojan-vs-code-extension-brought-down-github/)
- [Compromised Nx Console 18.95.0 Targeted VS Code Developers with Credential Stealer](https://thehackernews.com/2026/05/compromised-nx-console-18950-targeted.html)
- [GitHub links repo breach to TanStack npm supply-chain attack](https://www.bleepingcomputer.com/news/security/github-links-repo-breach-to-tanstack-npm-supply-chain-attack/)
- [GitHub Internal Repository Breach via Poisoned VS Code Extension (May 2026): TeamPCP Exfiltrates 3,800 Repos](https://phoenix.security/vs-code-extension-malware-github-breach-teampcp-2026/)
- [Mini Shai-Hulud Worm Compromises TanStack, Mistral AI, Guardrails AI & More Packages](https://thehackernews.com/2026/05/mini-shai-hulud-worm-compromises.html)
- [Our response to the TanStack npm supply chain attack](https://openai.com/index/our-response-to-the-tanstack-npm-supply-chain-attack/)
- [TanStack and 160+ npm/PyPI Packages Compromised in Supply Chain Worm Attack](https://orca.security/resources/blog/tanstack-npm-supply-chain-worm/)
- [Mini Shai-Hulud Is Back: npm Worm Hits over 160 Packages, including Mistral and Tanstack](https://www.aikido.dev/blog/mini-shai-hulud-is-back-tanstack-compromised)
- [TanStack npm Packages Compromised in Ongoing Mini Shai-Hulud Supply Chain Attack](https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack)
- [Supply Chain Attack Affecting Numerous npm and PyPI Packages (CC-4781)](https://digital.nhs.uk/cyber-alerts/2026/cc-4781)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0547