A Popular Developer Extension, a Quiet Update, and a Credential-Theft Risk
A compromised Nx Console package landing in the VS Code marketplace shows how a trusted extension update can become a high-value supply-chain risk for developers.
The danger in developer-tool attacks is not always the code editor itself. Sometimes it is the plugin sitting beside it, carrying the trust of a familiar name. In this case, the concern centers on a compromised Nx Console extension package, version 18.95.0, that was published to the Microsoft Visual Studio Code Marketplace and described as part of a credential-stealing targeting campaign.
Fast Facts
- The package in question was identified as rwl.angular-console version 18.95.0.
- It was published in the Microsoft Visual Studio Code Marketplace.
- The extension is associated with more than 2.2 million installations.
- The targeting description focused on VS Code developers and a credential stealer.
- Public information does not yet establish the responsible actor or the full compromise path.
Why this matters technically
Nx Console is not just a cosmetic add-on. It is a workflow extension used across editor environments, including VS Code, Cursor, and JetBrains-based tools, and its public listing highlights features such as project graph visualization, generator-oriented UI elements, CI notifications, and AI-context integrations. That mix makes package identity and update integrity especially important: a malicious change can sit inside a tool developers already trust.
Microsoft’s extension model helps reduce risk through marketplace scanning, publisher trust checks, and signed packages, but those controls do not eliminate exposure windows. In practice, a compromised update can be delivered before it is detected and removed. That is why the package name, version, and publisher chain matter as much as the extension’s popularity.
From a defensive perspective, the phrase “credential stealer” should be read as a threat model rather than proof of confirmed theft. MITRE ATT&CK’s credential-access guidance covers adversaries hunting stored secrets such as browser passwords and other saved credentials. If a developer workstation holds active sessions, API keys, or browser-stored logins, the broader risk is that one compromised extension could become a launch point for account abuse elsewhere.
At the time of writing, public information has not fully established the technical root cause, the complete scope of affected users, or whether downstream systems were compromised. The available information supports a risk analysis, not a definitive attribution of negligence or full compromise.
Defensive lessons
This kind of event rewards discipline over convenience. Developers and security teams should verify extension IDs and publisher details, prefer trusted packages, and review update history before deployment. In managed environments, allowed-extension policies can narrow the blast radius. Workspace Trust is also relevant because it limits what untrusted folders can trigger inside VS Code.
If the suspicious extension was installed, a cautious response is to remove it and rotate passwords, API keys, and tokens that may have been present on the same machine. Monitoring for unusual access to credential stores can help spot follow-on activity. The broader lesson is simple: in a software supply chain, a single editor plugin can become a security boundary all by itself.
Conclusion
The compromise of a trusted extension update is not just an annoyance for developers; it is a reminder that productivity tooling now lives close to identity, source code, and session secrets. Popularity does not equal safety. In modern development environments, provenance is part of security, and every update deserves scrutiny.
TECHCROOK
Hardware security key: A hardware security key adds a physical second factor for logins to email, code hosting, and other sensitive accounts. It is a practical option for developers who want stronger protection for passwords, tokens, and session-based access on work machines.
WIKICROOK
- Supply-chain attack: A compromise of software distribution or update channels to reach downstream users.
- Credential stealer: Malware designed to collect passwords, tokens, or other authentication material.
- Marketplace trust: The assumption that an app store or extension store package is legitimate and safe to install.
- Workspace Trust: A VS Code control that limits risky actions when a folder has not been trusted.
- Credential store: A place where browsers or apps keep saved logins, secrets, or session data.
