s1ngularity: Nx supply-chain attack weaponises local AI coding CLIs to steal secrets
- occurred
- 2025-08-26
- reported
- 2025-08-27
- location
- online
- domain
- software engineering
- agent system
- Claude Code, Gemini CLI and Amazon Q CLI, invoked by malicious Nx npm packages
- reporter
- VAIDDB editorial
- origin
- editorial
== SUMMARY ==
Malicious Nx package versions ran developers' own AI coding CLIs with safety flags disabled, instructing them to hunt for credentials and publish them to public GitHub repositories.
== DESCRIPTION ==
On the night of 26-27 August 2025, 19 compromised versions of Nx and its plugins were published to npm using a stolen publish token. The postinstall script invoked whichever AI coding CLI it found on the machine — claude --dangerously-skip-permissions, gemini --yolo, q chat --trust-all-tools — with a prompt telling the agent to inventory sensitive files.
The harvested npm tokens, SSH keys, API keys and cryptocurrency wallets were published to public repositories named s1ngularity-repository-NNNN on the victims' own GitHub accounts. The packages were live for about five hours and twenty minutes. GitHub later made the repositories private, but thousands of developers' secrets had been publicly exposed. This is the first widely documented case of malware using the victim's own AI agents as the exfiltration tool.
== ROOT CAUSE ==
Locally installed AI CLIs accepted a fully permissive, non-interactive mode, turning them into a general-purpose credential-harvesting tool for any process that could run a shell command.
== MITIGATION ==
npm removed the packages, Nx revoked the compromised token and published an advisory, GitHub disabled the exfiltration repositories, and affected developers were told to rotate every credential.
== REFERENCES ==
- news NX build compromise: detection and response to the s1ngularity supply-chain attack — Kaspersky, 2025-08-29
- official report s1ngularity's aftermath: analysis of the Nx supply chain attack — Wiz, 2025-08-29
- official report Malicious versions of Nx and some supporting plugins were published (GHSA-cxm3-wv7p-598c) — Nx / GitHub Security Advisories, 2025-08-27
== INVESTIGATION ==
Traced the compromise to an npm publish token stolen through a vulnerable GitHub Actions workflow; published a security advisory and remediation guidance.
== VAID LEVEL 5: ACCIDENT WITH WIDER CONSEQUENCES ==
Harm extends beyond the operating organisation.
- Third parties materially affected (customers, partners, public).
- Large-scale leak of personal data or credentials.
- Regulatory intervention or mandatory public disclosure required.