Compromised VS Code Extension Steals Credentials

A compromised version of the popular Nx Console extension for VS Code was found to contain a credential stealer, affecting its large user base.

Security researchers have identified a malicious version of the widely-used Nx Console extension on the official Microsoft Visual Studio Code (VS Code) Marketplace. The compromised version, specifically 18.95.0 of the extension identified as rwl.angular-console, was found to contain a credential stealer. Nx Console is a popular user interface plugin for various code editors, including VS Code, Cursor, and JetBrains, and the VS Code extension alone boasts over 2.2 million installations. The malicious code was embedded within what appeared to be a legitimate update, tricking developers into installing a tool designed to steal their sensitive information.

This incident poses a significant security risk, as developers' machines are gateways to critical company assets. Stolen credentials can grant attackers access to source code repositories, cloud infrastructure accounts, internal networks, and other sensitive systems. The large installation base of Nx Console means the potential impact is widespread, affecting everyone from individual developers to large enterprise teams. This attack underscores the growing trend of supply chain attacks targeting the software development lifecycle, where trusted tools are weaponized. It highlights the vulnerability of even official and popular extensions within widely-used development environments.

This attack targets developers directly, turning a trusted tool into a credential stealer. Stolen developer credentials can provide attackers with deep access to source code, cloud infrastructure, and other critical company assets, leading to major security breaches.

A breach originating from a compromised developer tool can lead to intellectual property theft, data exfiltration, and costly system downtime. It damages company reputation and customer trust, and can result in significant financial losses from incident response and recovery efforts.