Nx Console EUVD-2026-32550

The exact prerequisite is that the victim installed or auto-updated Nx Console to the trojanized build 18.95.0 from the Visual Studio Marketplace or OpenVSX during its live window on 19 May 2026 - there is no separate configuration flag or feature to enable; possessing and loading that specific package is the condition. Exploitation is strictly limited by the extremely short availability window (~18 minutes on the Visual Studio Marketplace, 12:30-12:48 UTC; ~36 minutes on OpenVSX, 12:33-13:09 UTC), so only developers who fetched the extension in those minutes are at risk, and editors with auto-update disabled or extension versions pinned were not exposed. Although the CVSS vector states UI:N/PR:N, the supply-chain delivery means the practical limiting factor is acquisition of the malicious package within that narrow timeframe rather than any always-on remote reachability.

The signals are unusually consistent on severity but diverge on blast radius. CVSS 4.0 scores this 9.3 with AV:N/AC:L/AT:N/PR:N/UI:N and high confidentiality/integrity/availability impact, CISA KEV confirms active exploitation, SSVC marks it automatable with total technical impact, and a public exploit exists - every per-infection indicator points to critical. However, the practical exposure is sharply bounded by time: the malicious version was downloadable for only ~18 minutes on the Visual Studio Marketplace and ~36 minutes on OpenVSX before removal, so the realistic victim population is limited to developers who installed or auto-updated in that narrow window. Note also a tension in the CVSS vector: it asserts UI:N (no user interaction), yet exploitation in practice requires a victim to obtain and run the compromised package, so the network/no-interaction framing reflects the malware's automatic execution once installed rather than truly passive remote compromise - verify scope against the vendor postmortem before treating it as wormable. Net: treat as a high-priority incident-response and credential-rotation event for anyone who touched 18.95.0, but the short availability window makes widespread mass exploitation unlikely.

A developer with Nx Console installed and auto-update enabled has their editor silently pull version 18.95.0 during the brief window it is live on the marketplace; on load, the embedded malicious code runs with the developer's privileges and harvests environment secrets, tokens, and workspace credentials, exfiltrating them to attacker infrastructure. Public exploit code and the vendor's indicators of compromise confirm the technique, and because no further user interaction is needed once the extension is installed (AV:N/AC:L), each infection is fully automatable.