CVE-2026-48027: Nx Console Embedded Malicious Code Vulnerability

Nx Console is an extension that contains embedded malicious code. A malicious version was published to users, and once installed the extension fetched an obfuscated payload that harvested credentials from disk and memory. The issue matters because the compromise has been used in ransomware activity and can lead to credential theft across developer environments.

How it works

The weakness is classified as CWE-506, embedded malicious code. An attacker abuses the distribution channel by publishing a malicious version of the extension. Once loaded, the extension retrieves an obfuscated payload that reads credentials from multiple locations on disk and in memory. No further exploit mechanics are provided in the available record.

Am I affected? How to find it in your systems

Nx Console typically runs as an IDE extension or command-line console component in developer workstations and build environments. Inventory installed extensions through your IDE marketplace or extension manager and compare the installed package against the versions listed in the vendor advisory. Review extension installation logs and any outbound network connections initiated by the extension process for signs of unexpected payload retrieval. Specific version checks and configuration details must be confirmed against the vendor advisory.

How to remediate

Apply mitigations per the vendor instructions as the primary step. Remove or replace any installed instance of Nx Console that matches the compromised publication. After remediation, audit stored credentials that may have been accessible to the extension and rotate those credentials where exposure is possible.

If you can't patch immediately

Follow applicable BOD 22-01 guidance for cloud services. Segment developer workstations and build systems so that the extension cannot reach credential stores or external command-and-control endpoints. Monitor process execution and network traffic for the affected extension. Discontinue use of the product if mitigations cannot be applied.

If your data may have been exposed

Actively exploited vulnerabilities of this type have led to breaches. You can run a free exposure scan of your email addresses to check known breach data.