--- title: Best StepSecurity posts — May 2026 | daily.dev description: The most upvoted StepSecurity posts from May 2026, curated by the daily.dev community. canonical: https://daily.dev/sources/stepsecurity/best-of/2026/05 twitter:card: summary_large_image twitter:site: @dailydotdev og:url: https://daily.dev/sources/stepsecurity/best-of/2026/05 og:type: website og:site_name: daily.dev og:title: Best StepSecurity posts — May 2026 | daily.dev og:description: The most upvoted StepSecurity posts from May 2026, curated by the daily.dev community. og:image: https://media.daily.dev/image/upload/s--VAY5ToZt--/f_auto/v1724209435/public/daily.dev%20-%20open%20graph --- # Best of StepSecurity — May 2026 1. 1 [](https://daily.dev/posts/active-supply-chain-attack-malicious-node-ipc-versions-published-to-npm-zhegwtj50 "Active Supply Chain Attack: Malicious node-ipc Versions Published to npm") Article StepSecurity · 17w Active Supply Chain Attack: Malicious node-ipc Versions Published to npm StepSecurity has detected an active supply chain attack targeting the widely used node-ipc npm package. Three versions (9.1.6, 9.2.3, and 12.0.1) are confirmed compromised, containing obfuscated payloads that exfiltrate cloud credentials, SSH keys, and CI/CD secrets to an external C2 server upon package installation. Developers are advised to immediately remove affected versions, pin to a known-clean release, audit any environments that may have installed these versions, and rotate all secrets if a CI/CD pipeline was affected. Full reverse-engineering of the payload is ongoing. 29 2. 2 [](https://daily.dev/posts/nx-console-vs-code-extension-compromised-vjwmbj36q "Nx Console VS Code Extension Compromised") Article StepSecurity · 16w Nx Console VS Code Extension Compromised Nx Console VS Code extension (nrwl.angular-console), with over 2.2 million installs, was compromised in version 18.95.0\. The malicious version was published outside the normal CI/CD pipeline using likely stolen credentials, injecting code that runs an obfuscated \~498 KB JavaScript payload on every workspace activation. The payload is a sophisticated multi-stage credential stealer targeting GitHub, NPM, AWS, Kubernetes, SSH keys, and more, with three exfiltration channels including DNS tunneling. It also includes persistence mechanisms, CI/CD targeting, and Sigstore attestation forgery capabilities. This is the second supply chain attack against the Nx ecosystem in under a year. Affected users should update to 18.100.0 immediately, check for persistence artifacts, and rotate all credentials. 36 2 [See all StepSecurity archives](/sources/stepsecurity/best-of) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@graph":[{"@type":"CollectionPage","@id":"https://daily.dev/sources/stepsecurity/best-of/2026/05#page","url":"https://daily.dev/sources/stepsecurity/best-of/2026/05","name":"Best StepSecurity Posts — May 2026","description":"The most upvoted StepSecurity posts from May 2026, curated by the daily.dev community.","isPartOf":{"@type":"WebSite","url":"https://daily.dev"}},{"@type":"ItemList","@id":"https://daily.dev/sources/stepsecurity/best-of/2026/05#items","numberOfItems":2,"itemListElement":[{"@type":"ListItem","position":1,"url":"https://daily.dev/posts/active-supply-chain-attack-malicious-node-ipc-versions-published-to-npm-zhegwtj50","name":"Active Supply Chain Attack: Malicious node-ipc Versions Published to npm"},{"@type":"ListItem","position":2,"url":"https://daily.dev/posts/nx-console-vs-code-extension-compromised-vjwmbj36q","name":"Nx Console VS Code Extension Compromised"}]},{"@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Sources","item":"https://daily.dev/sources"},{"@type":"ListItem","position":3,"name":"StepSecurity","item":"https://daily.dev/sources/stepsecurity"},{"@type":"ListItem","position":4,"name":"Best of","item":"https://daily.dev/sources/stepsecurity/best-of"},{"@type":"ListItem","position":5,"name":"May 2026"}]}]} ```