Compromised Nx Console v18.95.0: VS Code Supply Chain Attack and Credential Theft

---
title: Installation of Compromised Nx Console Extension v18.95.0
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
status: experimental
description: Detects the installation or presence of the compromised rwl.angular-console extension version 18.95.0 which contains a credential stealer.
references:
  - https://thehackernews.com/2026/05/compromised-nx-console-18950-targeted.html
author: Security Arsenal
date: 2026/05/20
tags:
  - attack.initial_access
  - attack.t1195.002
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains: '\.vscode\extensions\rwl.angular-console-18.95.0'
  condition: selection
falsepositives:
  - Legitimate installation of this specific version (highly unlikely given current context)
level: critical
---
title: Installation of Compromised Nx Console Extension v18.95.0 (Linux/Mac)
id: b2c3d4e5-6789-01ab-cdef-2345678901bc
status: experimental
description: Detects the installation or presence of the compromised rwl.angular-console extension version 18.95.0 on Linux or macOS systems.
references:
  - https://thehackernews.com/2026/05/compromised-nx-console-18950-targeted.html
author: Security Arsenal
date: 2026/05/20
tags:
  - attack.initial_access
  - attack.t1195.002
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains: '/.vscode/extensions/rwl.angular-console-18.95.0'
  condition: selection
falsepositives:
  - Legitimate installation of this specific version
level: critical
---
title: Potential VS Code Extension Host Spawn Suspicious Process
id: c3d4e5f6-7890-12ab-def0-3456789012cd
status: experimental
description: Detects suspicious child processes spawned by the VS Code extension host, which could indicate malicious activity from a compromised extension.
references:
  - https://thehackernews.com/2026/05/compromised-nx-console-18950-targeted.html
author: Security Arsenal
date: 2026/05/20
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\Code.exe' or ParentImage|endswith: '\helper.exe' or ParentImage|endswith: '\node.exe'
    ParentCommandLine|contains: '--extensionHost'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\bash.exe'
      - '\curl.exe'
  filter_legit_devtools:
    CommandLine|contains: 'git' or CommandLine|contains: 'npm' or CommandLine|contains: 'yarn'
  condition: selection_parent and selection_child and not filter_legit_devtools
falsepositives:
  - Developers running legitimate build scripts or terminal commands from within VS Code
level: medium

// Hunt for the specific malicious extension version in file creation logs
DeviceFileEvents
| where FolderPath contains ".vscode/extensions"
| where FolderPath contains "rwl.angular-console"
| where FolderPath contains "18.95.0"
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, FolderPath, ActionType
| extend Tip = "Verify if this is the compromised Nx Console version and remove immediately."

-- Hunt for the malicious Nx Console extension directory on endpoints
SELECT FullPath, Mtime, Atime, Size, Mode
FROM glob(globs="/*/.vscode/extensions/rwl.angular-console-18.95.0/*")
LIMIT 100

# Remediation Script: Detect and Remove Malicious Nx Console Extension
# Requires Administrator privileges

$ErrorActionPreference = "Stop"

Write-Host "Starting scan for compromised Nx Console extension (rwl.angular-console-18.95.0)..." -ForegroundColor Cyan

# Define potential VS Code extension paths (User and System scope)
$extensionPaths = @(
    "$env:USERPROFILE\.vscode\extensions",
    "$env:APPDATA\Code\extensions",
    "C:\Program Files\Microsoft VS Code\extensions",
    "C:\Program Files (x86)\Microsoft VS Code\extensions"
)

$maliciousFolderName = "rwl.angular-console-18.95.0"
$foundThreat = $false

foreach ($basePath in $extensionPaths) {
    if (Test-Path $basePath) {
        $targetPath = Join-Path -Path $basePath -ChildPath $maliciousFolderName
        
        if (Test-Path $targetPath) {
            Write-Host "[THREAT FOUND] Malicious extension detected at: $targetPath" -ForegroundColor Red
            $foundThreat = $true
            try {
                # Backup logs before removal
                $logsPath = Join-Path -Path $targetPath -ChildPath "extension.vsixmanifest"
                if (Test-Path $logsPath) {
                    Write-Host "Analyzing manifest..." -ForegroundColor Yellow
                }

                Write-Host "Removing directory: $targetPath" -ForegroundColor Yellow
                Remove-Item -Path $targetPath -Recurse -Force -ErrorAction Stop
                Write-Host "[SUCCESS] Malicious extension removed." -ForegroundColor Green
            }
            catch {
                Write-Host "[ERROR] Failed to remove $targetPath. Manual deletion required. Error: $_" -ForegroundColor Red
            }
        }
    }
}

if (-not $foundThreat) {
    Write-Host "No instances of the malicious extension found on this system." -ForegroundColor Green
} else {
    Write-Host "" -NoNewline
    Write-Host "REMEDIATION ACTION REQUIRED:" -ForegroundColor Cyan
    Write-Host "1. Restart Visual Studio Code immediately."
    Write-Host "2. Reinstall the Nx Console extension from a verified clean version (e.g., 18.95.1+ or latest)."
    Write-Host "3. Assume credential compromise: Rotate all GitHub tokens, AWS keys, and other secrets stored on this host."
}