Case nx-s1ngularityAI supply chainWorldwide
s1ngularity: trojanized Nx packages weaponize Claude and Gemini CLIs to steal secrets
Malicious Nx npm releases ran local AI coding CLIs with permission-bypass flags to inventory secrets, then leaked thousands of developer credentials to public GitHub repos.
CriticalAttack on AIStatus: ContainedVerified case file
Open in the interactive mapCite this case
- Reported
- Aug 27, 2025
- Location
- Worldwide
- Target
- Nx build system users
- Severity
- Critical
- Triggered by
- Unknown supply-chain attacker (s1ngularity)
- Actor type
- Criminal
- Reported loss
- None reported
- CVE
- None
What happened
Malicious Nx npm releases ran local AI coding CLIs with permission-bypass flags to inventory secrets, then leaked thousands of developer credentials to public GitHub repos.
Impact: Over 2,000 secrets and 20,000 files leaked from about 1,000 developers; 480 accounts and about 6,700 private repositories made public; 2,180 accounts affected overall per Wiz
Who triggered it
Actor: Unknown supply-chain attacker (s1ngularity)
Attribution: No public attribution; analysed by Nx maintainers, Wiz, StepSecurity, Socket and GitHub Security Lab
Motive: Mass theft of developer secrets (GitHub and npm tokens, SSH keys, crypto wallets, cloud credentials)
How it happened
Attack vector: Malicious postinstall script in Nx npm releases 20.9.0 to 21.8.0 ran Claude, Gemini and Q CLIs with permission-bypass flags to find secrets, then pushed them to public GitHub repos
Root cause: Nx GitHub Actions workflow using pull_request_target with an unsanitised PR title let the attacker steal the npm publish token from an outdated branch
Timeline
- Vulnerable workflow added to Nx repo; reverted on master but still present on an outdated branch
- Attacker publishes trojanized Nx versions to npm; malware runs AI CLIs and leaks secrets for several hours
- Nx pulls malicious versions, revokes tokens and publishes advisory GHSA-cxm3-wv7p-598c
- Second phase: stolen GitHub tokens used to flip about 6,700 private repos public across 480 accounts
- Wiz reports 2,180 accounts and 7,200 repositories affected across three phases
Response
Nx revoked npm tokens, removed packages, enforced 2FA and trusted publishing; GitHub removed leaked repositories; victims told to rotate all credentials
Current status: Contained
Sources (open in a new tab)
- Okta okta.com
- Wiz wiz.io
- BleepingComputer bleepingcomputer.com
- GitHub Security Lab securitylab.github.com
Cite this case
s1ngularity: trojanized Nx packages weaponize Claude and Gemini CLIs to steal secrets. AI Threat Watch, case nx-s1ngularity, Aug 27, 2025. https://aithreat.io/cases/nx-s1ngularity/
Permanent link: https://aithreat.io/cases/nx-s1ngularity/