A compromised version of the Nx Console VS Code extension (18.95.0) was published to the Microsoft VS Code Marketplace. This version silently executed a 498 KB obfuscated credential stealer payload, harvesting developer secrets from 1Password, Anthropic Claude Code, npm, GitHub, and AWS, and installing a Python backdoor on macOS systems.
Initial Access
Developer Credential Theft
confirmed
An Nx Console developer's machine was compromised in a prior security incident, leading to the leakage of their GitHub credentials.
Defender cut points
Implement strong endpoint security for developer workstationsEnforce phishing-resistant MFA for all developer accountsRegularly audit developer workstation security configurations
