Suspicious Nx Console 18.95.0 Compromise Artifacts and Python Payload Execution
Detects file and process activity related to the compromised Nx Console 18.95.0 VS Code extension, including known payload artifacts such as cat.py, kitty staging paths, LaunchAgent persistence, and daemonized execution indicators. This may indicate possible supply-chain compromise activity on a developer endpoint. Nx confirmed that version 18.95.0 was malicious and wrote artifacts such as ~/.local/share/kitty/cat.py, /tmp/kitty-*, /var/tmp/.gh_update_state, and macOS LaunchAgent persistence.
Microsoft Sentinel (KQL)
