Critical Credential Harvesting Vulnerability in Nx Console (CVE‑2026‑48027) Enables Malicious Extension Distribution
What It Is — Nx Console contains an embedded malicious‑code flaw that allowed a maliciously crafted version of the extension to be published to the official marketplace. The rogue extension fetched an obfuscated payload capable of harvesting credentials from files and memory on the developer’s workstation.
Exploitability — The malicious extension is publicly available; no additional authentication is required to install it. Public proof‑of‑concept exists via the published package. A CVSS score has not been issued yet, but the credential‑theft impact rates it as high severity.
Affected Products — Nx Console (the VS Code extension for the Nx build system) – all versions prior to the vendor’s forthcoming fix.
Why It Matters for Trust & Control Assurance
- Continuous third‑party risk monitoring is required to prove due‑diligence when consuming open‑source or marketplace extensions.
- Evidence of vendor oversight (e.g., signed packages, provenance checks) becomes audit‑ready proof for control objectives that span NIST CSF, ISO 27001, SOC 2 and other frameworks.
- A compromised developer tool can cascade credential exposure across downstream services, threatening the integrity of the entire software supply chain.
Recommended Actions
- Inventory all machines and CI pipelines that install Nx Console.
- Remove the vulnerable extension or upgrade to the patched version as soon as it is released.
- Enable package‑signing verification and enforce a whitelist of approved extensions.
- Capture remediation steps in your control‑evidence repository to satisfy audit requirements.
Source: CISA KEV – CVE‑2026‑48027