Worked example · 2026-05

Nx Console VS Code extension — trojanised release (nrwl.angular-console v18.95.0) credential stealer — 2026-05-18

Loss: No direct on-chain theft is publicly attributed to this incident; the loss is credential and source-code exfiltration at ecosystem scale — a multi-stage stealer harvested GitHub, npm, AWS, HashiCorp Vault, Kubernetes and 1Password tokens and exfiltrated ~3,800 internal repositories from affected GitHub organisations. The crypto relevance is the pre-positioning value of the stolen material: npm-publish tokens, cloud secrets, and CI credentials belonging to Web3 development teams are exactly the inputs to downstream package-poisoning and key-exfiltration attacks. Notably, the payload also targeted ~/.claude/settings.json — AI-coding-assistant configuration — one of the first supply-chain payloads observed harvesting AI-assistant credentials.
OAK Techniques observed: OAK-T15.002 (Supply-Chain / Vendor-Pipeline Compromise — the canonical anchor. A trusted developer tool (the Nx Console VS Code extension, 2.2M+ installs) shipped a malicious release that executed on every workspace open. See techniques/T15.002-supply-chain-vendor-pipeline-compromise.md). OAK-T15.004 (Operator-Side Credential Compromise — the entry vector: an Nx developer's GitHub credentials were leaked via a prior TanStack npm supply-chain compromise, which the attacker used to publish the trojanised extension; the payload then harvested package-registry / SSO / cloud / DNS credentials at scale). OAK-T11.009 (Trader-Tooling Supply-Chain Compromise targeting keys — cross-referenced: the stealer's harvest of npm tokens, cloud secrets and key material is the same primitive OAK tracks where developer-tooling compromise leads to private-key / publish-token exfiltration).
Attribution: inferred-strong (claimed). The threat group TeamPCP claimed responsibility and advertised the stolen data on cybercrime forums; Nx acknowledged that one of its developers was compromised by a prior supply-chain compromise targeting TanStack, leaking the GitHub credentials used to publish the malicious extension. CISA issued an alert; StepSecurity, OX Security, and the Nx team's own postmortem documented the chain. This is a named-actor-claimed, vendor-confirmed incident.
Key teaching point: Nx Console is the 2026 worked example of a developer-IDE-extension supply-chain compromise feeding a credential-harvesting machine — and the first widely-documented payload to deliberately target AI-coding-assistant configuration (~/.claude/settings.json) alongside the usual GitHub/npm/cloud secrets. Two structural features make it instructive for OAK. First, the compromise was self-propagating across the ecosystem's trust graph: a TanStack-side compromise leaked an Nx developer's credentials, which were used to poison Nx, whose 2.2M-install extension then harvested more credentials — supply-chain compromises chain through shared maintainer/credential surfaces. Second, the payload hid in plain sight: the 498 KB stealer was fetched from a dangling orphan commit inside the official nrwl/nx GitHub repository, so the malicious code lived behind a legitimate, trusted URL. The detection-signal locus is the developer-endpoint and credential-rotation layer: any environment that ran the trojanised extension during its exposure window must assume full credential compromise and rotate GitHub/npm/cloud/AI-assistant tokens immediately.

Summary

The Nx Console VS Code extension (nrwl.angular-console, 2.2M+ installations) is a widely-used developer tool for the Nx monorepo build system. On 2026-05-18, a trojanised version v18.95.0 was published to the Visual Studio Code Marketplace. Within seconds of a developer opening any workspace, the compromised extension silently fetched and executed a 498 KB obfuscated payload from a dangling orphan commit hidden inside the official nrwl/nx GitHub repository — a location that resolves under a trusted domain and repo.

The payload was a multi-stage credential stealer and supply-chain-poisoning tool. It harvested tokens and secrets from GitHub, npm, AWS, HashiCorp Vault, Kubernetes and 1Password, and specifically read ~/.claude/settings.json (AI-coding-assistant configuration). It exfiltrated over three independent channels — HTTPS, the GitHub API, and DNS tunnelling — to survive egress filtering. Downstream, the breach enabled exfiltration of approximately 3,800 internal repositories from affected GitHub organisations.

The malicious version was live for roughly 11 minutes before the Nx team pulled it, but auto-update meant any environment with Nx Console set to update automatically during the window should assume compromise. Nx's postmortem traced the entry vector to a prior TanStack npm supply-chain compromise that leaked an Nx developer's GitHub credentials; the attacker used those to publish the trojanised extension. The group TeamPCP claimed the breach. CISA issued a supply-chain alert.

Why this is structurally significant

Nx Console belongs to the corpus's T15.002 supply-chain family alongside the Ledger Connect Kit library compromise (2023-12), the Solana web3.js npm compromise (2024-12), and the embedded-wallet / trader-tooling supply-chain cohort (2024–2026). It advances that lineage on three axes:

IDE-extension delivery, not a library dependency. Earlier cases poisoned a package a project imports. Nx poisoned an editor extension that executes automatically on workspace open, with no import statement and no build step — a broader and more immediate execution surface that reaches every developer who has the extension installed, regardless of which project they open.
Trust-graph chaining. The compromise originated in a different project (TanStack) and propagated through a shared credential surface into Nx. This is the supply-chain analogue of operator-continuity: the attacker moved laterally across the open-source maintainer graph, and the relevant defensive unit is not a single project but the credential trust graph connecting maintainers.
Payload hidden in a legitimate repository. Staging the stealer in a dangling orphan commit inside the official nrwl/nx repo meant the fetch URL was trusted infrastructure. Network- and provenance-based detection that allowlists "official repo" domains would not have flagged the fetch.

The ~/.claude/settings.json targeting is the forward-looking signal. As AI coding assistants become standard in developer and Web3-engineering workflows, their local configuration and credential files become a new harvest target — and one that may carry API keys, MCP server credentials, or tokens with their own blast radius. OAK should record AI-assistant configuration as an emerging credential-harvest target within T15.002 / T15.004.

The crypto-specific relevance is indirect but real: the harvested material (npm-publish tokens, AWS/Vault secrets, GitHub write access for ~3,800 repos) is precisely the input set for the next supply-chain or key-exfiltration attack against a Web3 project — the same pre-positioning-then-exploit pattern OAK tracks under T11.009 and the trader-tooling cohort. A credential-harvest event of this scale is a fan-out into many potential downstream on-chain incidents.

Timeline (UTC)

When	Event	OAK ref
Pre-2026-05-18	A prior TanStack npm supply-chain compromise leaks an Nx developer's GitHub credentials	T15.004 (operator credential compromise — entry vector)
2026-05-18	Trojanised Nx Console `nrwl.angular-console` v18.95.0 published to the VS Code Marketplace (2.2M+ installs)	T15.002 (supply-chain / vendor-pipeline compromise)
2026-05-18	On workspace open, the extension fetches and executes a 498 KB obfuscated payload from a dangling orphan commit in the official `nrwl/nx` GitHub repo; harvests GitHub/npm/AWS/Vault/Kubernetes/1Password secrets and reads `~/.claude/settings.json`; exfiltrates over HTTPS + GitHub API + DNS tunnelling	T15.002 execution (multi-channel credential stealer)
2026-05-18 (~11 min later)	Nx team pulls the malicious version from the marketplace; auto-update users in the window remain exposed	(operator response)
2026-05-18 to 05-20	Downstream: ~3,800 internal repositories exfiltrated from affected GitHub organisations; TeamPCP claims responsibility and advertises stolen data	T15.004 (credential abuse at scale)
2026-05-28	CISA issues a supply-chain alert; StepSecurity / OX Security / Nx postmortem document the chain	(third-party detection / advisory)

What defenders observed

Pre-event (maintainer-credential layer): the entry vector was a leaked developer credential from an unrelated prior compromise (TanStack). Defender lesson: maintainer credentials are a shared-blast-radius asset across the open-source graph; hardware-backed 2FA, short-lived publish tokens, and scoped CI credentials limit how far a single leaked credential propagates.
At-event (execution surface): the extension executed a remote payload on workspace open. An IDE-extension that fetches and runs remote code with no user action is an anti-pattern; endpoint controls that block extensions from spawning shells / making outbound DNS-tunnel traffic would have surfaced it. The payload's use of three exfil channels (HTTPS, GitHub API, DNS) is designed to defeat single-channel egress filtering.
At-event (provenance blind spot): the payload was hosted in a dangling orphan commit inside the official nrwl/nx repo — a trusted URL. Provenance/allowlist defenses keyed on "official repo" would not flag it; commit-graph hygiene (detecting unreferenced orphan commits in a published repo) is the relevant control.
Post-event (rotation imperative): with auto-update, exposure was silent and broad. Any environment that ran the extension in the window must rotate GitHub/npm/AWS/Vault/Kubernetes/1Password and AI-assistant credentials and audit for unauthorised repo access. The ~3,800-repo exfiltration is a fan-out of future risk, not a closed loss.

What this example tells contributors writing future Technique pages

T15.002 should cover IDE-extension delivery as a distinct sub-shape. Editor extensions execute automatically and broadly, without an import or build step. The execution surface and detection guidance differ from poisoned package dependencies and warrant separate treatment.
Record supply-chain trust-graph chaining. When a compromise originates in project A (TanStack) and propagates into project B (Nx) via a shared maintainer credential, the incident is a chain, and the defensive unit is the credential graph, not the single project. This is the supply-chain analogue of T8 operator continuity.
AI-assistant configuration is an emerging credential-harvest target. The ~/.claude/settings.json targeting is a first-of-kind signal. Contributors should add AI-assistant config/credential files to the T15.002 / T15.004 harvest-target inventory.
Credential-harvest scale is a fan-out metric, not a loss figure. With no direct on-chain theft but ~3,800 repos and broad secret exfiltration, the right "impact" field is downstream exposure (what the stolen credentials can unlock), recorded alongside the (here, zero) direct loss.

Public references

CISA — Supply Chain Compromises Impact Nx Console and GitHub Repositories — official advisory.
StepSecurity — Nx Console VS Code Extension Compromised — technical breakdown.
The Hacker News — Compromised Nx Console 18.95.0 Targeted VS Code Developers with Credential Stealer
Nx Blog — Postmortem: Nx Console v18.95.0 supply-chain compromise — vendor postmortem; TanStack-credential entry vector.
OX Security — TeamPCP Strikes (again): How a Trojan VS Code Extension Brought Down GitHub — attribution (TeamPCP).
BleepingComputer — GitHub links repo breach to TanStack npm supply-chain attack

Discussion

Nx Console extends the corpus's T15.002 supply-chain coverage from poisoned packages (Ledger Connect Kit, Solana web3.js) to poisoned IDE extensions, and from single-project compromises to trust-graph chaining across the open-source maintainer surface (TanStack → Nx). Its inclusion in OAK is justified less by any direct on-chain loss — there is none publicly attributed — than by its role as a pre-positioning fan-out: it is exactly the kind of mass credential-and-source-code harvest that seeds the next package-poisoning or key-exfiltration attack against Web3 teams, the pattern the corpus tracks under T11.009 and the embedded-wallet / trader-tooling supply-chain cohort.

The two details most worth preserving are the dangling-orphan-commit staging (malware behind a trusted official-repo URL, defeating provenance allowlists) and the ~/.claude/settings.json targeting (AI-assistant credentials as a new harvest class). Both are forward-looking signals: as developer workflows centralise on a few high-trust tools and AI assistants, the value of compromising any one of them — and the breadth of what a single trojanised release can harvest — grows. The defensive posture the case argues for is hardware-backed maintainer auth, scoped/short-lived publish and cloud tokens, IDE-extension execution sandboxing, commit-graph hygiene on published repos, and treating AI-assistant configuration as sensitive credential material.