• Threat Type: Software Supply Chain Attack — Trojanized VS Code Extension via Chained GitHub Token Compromise

• Severity: Critical

• CVE Reference: No CVE assigned for the Nx Console compromise. GHSA-c9j4-9m59-847w is the official advisory. The upstream TanStack campaign is tracked separately as GHSA-g7cv-rxg3-hmpx.

• Affected Components: Nx Console VS Code extension (nrwl.angular-console) version 18.95.0 exactly. No earlier or later versions are affected. OpenVSX was also affected during a 36-minute window.

• Threat Actor: TeamPCP (Mini Shai-Hulud campaign)

• Exploit Status: Confirmed active exploitation; GitHub has disclosed internal repository exfiltration linked to this campaign

Attack Chain

• Attack originated from the May 11, 2026 TanStack npm supply chain compromise, where the malicious @tanstack/[email protected] package, one of 84 malicious versions published across 42 @tanstack/* packages, exfiltrated an Nx contributor's GitHub CLI OAuth token during a routine pnpm install operation. A minimum-release-age safeguard was configured but silently ignored due to an incompatible pnpm version (10.14), allowing the 77-minute-old malicious package to resolve without restriction.

• Attacker retained access to the stolen token for approximately seven days, conducting covert reconnaissance and workflow manipulation activity including bulk deletion of CodeQL Analysis workflow runs across Nx repositories before publishing the malicious extension.

• Using the compromised contributor credentials, the attacker pushed an unsigned orphan commit (558b09d7) to the official nrwl/nx repository containing a minimal malicious package with an obfuscated credential-stealing payload. The commit message was designed as a social engineering tactic to delay cleanup.

• Attacker published the trojanized nrwl.angular-console v18.95.0 extension to both the Visual Studio Marketplace and Open VSX using compromised VSCE_PAT publishing credentials. Both uploads passed automated security scanning without detection.

• Malicious code injected into main.js silently executed npx -y github:nrwl/nx#558b09d7 during workspace activation, fetching and launching a 498 KB obfuscated JavaScript payload without visible user interaction. A VS Code globalState key was set after first execution to prevent re-triggering.

• Payload implemented sandbox evasion (CPU count check, environment variable filtering) and self-daemonization before harvesting GitHub tokens, npm OIDC credentials, AWS access keys, HashiCorp Vault tokens, SSH keys, .env files, Docker configurations, GCP credentials, and Claude Code configuration files (~/.claude/settings.json). On Linux, the payload also attempted privilege escalation via passwordless sudo.

• Harvested data was encrypted using AES-256-GCM with RSA-4096 key wrapping and exfiltrated through HTTPS-based C2 traffic, GitHub API abuse using victim tokens, and DNS tunneling.

• Stolen npm OIDC tokens were abused to obtain legitimate Sigstore certificates through Fulcio/Rekor infrastructure, allowing malicious downstream npm packages to appear cryptographically trusted.

• Persistence was established through a Python backdoor (~/.local/share/kitty/cat.py) using GitHub Search API commit queries (firedalazer <base64-url>.<base64-signature>) as a covert dead-drop command-and-control channel with RSA-4096 signed payload delivery, executing hourly via a macOS LaunchAgent or equivalent platform mechanism.