CVE-2026-48027

What it actually does

CVE-2026-48027 is a malicious-package compromise of Nx Console, the Visual Studio Code/OpenVSX user interface extension for Nx and Lerna. The compromised extension version, 18.95.0, was briefly published to the Visual Studio Marketplace and OpenVSX registries and could execute attacker-supplied code in the context of the developer workstation or remote VS Code extension host where it was installed. Because editor extensions commonly have access to workspace files, source code, terminal-integrated workflows, environment variables, credentials available to the user, and developer tooling, successful installation could enable code theft, credential/session token theft, dependency or repository tampering, command execution, persistence through the extension, and staging for broader software supply chain compromise. Version 18.100.0 is identified as not compromised.

Why it matters to the business

This issue creates high business risk because it targets developer tooling rather than a public-facing application. A compromised developer extension can expose source code, build secrets, cloud credentials, signing material, package registry tokens, and CI/CD access paths, potentially enabling downstream product compromise or unauthorized releases. The issue is listed in CISA KEV, is marked as used in ransomware campaigns, and has a remediation due date of 2026-06-10, so organizations should treat any installation of Nx Console 18.95.0 as a security incident rather than a routine software update. Although the malicious version was available for a short window, the ecosystem impact can be broad because VS Code and OpenVSX extensions may be installed automatically or synchronized across developer workstations, containers, and remote development environments.

How an attack unfolds

An attacker abuses trust in the extension marketplace by publishing or causing publication of a malicious Nx Console release, version 18.95.0. A developer, automated workstation build, remote development container, or editor profile installs or updates to that version from Visual Studio Marketplace or OpenVSX during the exposure window. Once VS Code loads the extension, the malicious code executes with the privileges of the user running the editor or remote extension host. From there, the payload can inspect the current workspace, read project files, search for credentials and tokens, access environment variables, interact with developer CLIs, and make outbound network connections to attacker infrastructure. If valuable credentials are obtained, the attacker can pivot to source repositories, package registries, CI/CD systems, cloud accounts, or internal development services. In ransomware-related scenarios, stolen credentials and code access may be used to stage broader intrusion, data theft, extortion, or destructive deployment activity. Reported exploitation context includes the Nx Console embedded malicious code activity and broader emerging software supply chain intrusion campaigns.

How to fix it

Immediately remove Nx Console version 18.95.0 from all developer workstations, remote VS Code servers, dev containers, build images, and golden workstation images. Upgrade Nx Console to version 18.100.0 or a later trusted version from the official marketplace/source. If the compromised version was installed, treat the host and any repositories or credentials accessible from that host as potentially compromised: rotate developer credentials, source control tokens, package registry tokens, cloud keys, CI/CD secrets, SSH keys, and signing credentials that may have been available to the editor session. Rebuild affected dev containers or remote development environments from known-good images rather than only uninstalling the extension. Disable automatic extension updates where risk tolerance requires review/approval, pin approved extension versions, and restrict extension installation to trusted publishers and controlled registries where possible. For KEV compliance, complete remediation no later than 2026-06-10 where applicable.

How to confirm the fix worked

Confirm that no VS Code, VS Code Insiders, VSCodium, Cursor-compatible, OpenVSX-based, remote VS Code server, containerized development, or workstation image contains Nx Console 18.95.0. Validate installed extensions using editor extension lists, filesystem inspection of extension directories, endpoint inventory, EDR software inventory, and golden image scans. Check for extension directory names or package manifests showing nrwl.angular-console version 18.95.0. Confirm that the active installed version is 18.100.0 or later. For any system where 18.95.0 was present, validate that credential rotation has completed and that no unexpected source control, package registry, cloud, or CI/CD activity occurred after the installation time. Re-run inventory after remediation to verify the compromised version cannot be reinstalled through settings sync, cached extension packages, devcontainer definitions, or image rebuilds.

Typical attack path

1. Attacker publishes or injects a malicious Nx Console extension release identified as version 18.95.0 into Visual Studio Marketplace or OpenVSX.
2. Developer workstation, remote VS Code server, dev container, or synced editor profile installs or updates to the compromised extension version.
3. VS Code loads the extension and executes malicious extension code under the current user or remote extension-host account.
4. Malicious code enumerates workspaces, source files, environment variables, local configuration files, package manager credentials, cloud credentials, and developer tool tokens.
5. Payload attempts outbound communications to exfiltrate collected data or retrieve additional instructions.
6. Attacker uses stolen credentials or repository access to pivot into source control, CI/CD, package publishing, cloud services, or other development infrastructure.
7. Attacker may tamper with code, steal intellectual property, publish malicious downstream artifacts, or support ransomware/extortion operations.

How to detect it

Investigate whether Nx Console 18.95.0 was installed from Visual Studio Marketplace between 2026-05-19 12:30 and 12:48 UTC or from OpenVSX between 2026-05-19 12:33 and 13:09 UTC, while also accounting for local time zones, delayed synchronization, cached installs, and remote development environments. Review endpoint software inventories, EDR file telemetry, VS Code extension directories, VS Code settings sync state, remote VS Code server extension directories, devcontainer images, and workstation management logs. On affected systems, review VS Code and extension-host process telemetry for unusual child processes, shell execution, credential file reads, repository traversal, archive creation, and outbound network connections soon after extension activation. Relevant processes include Code, Code - Insiders, VSCodium, Electron, node, extensionHost, rg, git, npm, pnpm, yarn, npx, bash, sh, zsh, powershell.exe, pwsh.exe, cmd.exe, curl, wget, tar, zip, and 7z when spawned unexpectedly from editor or extension-host processes. Review source control audit logs for unusual clones, token usage, branch changes, force pushes, webhook changes, deploy key additions, and access from unfamiliar locations. Review package registry logs for token use, new tokens, package publication, dist-tag changes, and maintainer changes. Review cloud and CI/CD logs for secret access, new credentials, workflow edits, build script changes, runner registration, and unexpected deployment activity. Because malicious-package payloads can vary and may not leave stable network IOCs, absence of known indicators should not be considered proof of no compromise if version 18.95.0 was installed.

• nrwl.angular-console-18.95.0
• ~/.vscode/extensions/nrwl.angular-console-18.95.0
• ~/.vscode-insiders/extensions/nrwl.angular-console-18.95.0
• ~/.vscode-server/extensions/nrwl.angular-console-18.95.0
• ~/.vscode-server-insiders/extensions/nrwl.angular-console-18.95.0
• ~/.vscode-remote/extensions/nrwl.angular-console-18.95.0
• %USERPROFILE%\.vscode\extensions\nrwl.angular-console-18.95.0
• %USERPROFILE%\.vscode-insiders\extensions\nrwl.angular-console-18.95.0
• %USERPROFILE%\.vscode-server\extensions\nrwl.angular-console-18.95.0
• %USERPROFILE%\.vscode-server-insiders\extensions\nrwl.angular-console-18.95.0
• /root/.vscode-server/extensions/nrwl.angular-console-18.95.0
• /home/*/.vscode/extensions/nrwl.angular-console-18.95.0
• /home/*/.vscode-server/extensions/nrwl.angular-console-18.95.0
• "name": "angular-console"
• "publisher": "nrwl"
• "version": "18.95.0"
• nrwl.angular-console@18.95.0
• Nx Console 18.95.0
• extensionHost
• Code Helper (Plugin)
• Code.exe
• code.exe

What your security team should do

• Immediately inventory all developer endpoints, remote development hosts, containers, and base images for Nx Console version 18.95.0.
• Remove the compromised extension and upgrade to Nx Console 18.100.0 or later from a trusted source.
• Treat confirmed installations of version 18.95.0 as security incidents and begin credential exposure assessment.
• Rotate source control, package registry, cloud, CI/CD, SSH, API, and signing credentials that were accessible to affected users or environments.
• Review source control, package publishing, CI/CD, and cloud audit logs for suspicious activity following the extension installation window.
• Search endpoint telemetry for unexpected child processes, outbound network activity, archive creation, credential-file access, and repository enumeration by VS Code extension host processes.
• Rebuild affected remote development containers and VS Code server environments from known-good images.
• Implement allowlisting or approval workflows for developer extensions and monitor for newly installed or downgraded extensions.
• Disable or tightly govern automatic extension synchronization where it can propagate compromised extensions across systems.
• Prioritize remediation because the issue is in CISA KEV, has active in-the-wild exploitation, and is associated with ransomware activity.