A maliciously altered version of the Nx Console extension (18.95.0) was published to the Visual Studio Marketplace and OpenVSX for a brief period, allowing an attacker to deliver executable code to anyone who installs the extension. The impact is the potential compromise of the user’s system and the integrity of the development environment, as the injected code can run with the same privileges as the user. This is an example of abuse of a trusted third‑party component and is classified under CWE‑506.

The vulnerability affects the Nx Console extension from the vendor Nrwl, specifically version 18.95.0. All installations of this exact version are compromised, while the subsequent release, 18.100.0, is not affected.

The CVSS score of 9.3 indicates critical severity, and the vulnerability is listed in the CISA KEV catalog, underscoring its awareness and potential exploitation. Although EPSS data is not available, the exposure via the public marketplace and the short yet significant availability window suggest that the risk of exploitation is significant, provided an installer acquires the malicious package. The likely attack vector is the supply chain – a malicious or compromised publisher adds a new package revision that is automatically approved and installed by users. Users who have inadvertently installed the compromised version are at immediate risk, while those who have not installed the extension are not affected.