s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed
nx and @nx/* npm packages
Attackers abused a GitHub Actions injection bug in nrwl/nx to steal its npm token and published malicious nx and @nx/* versions for about four hours. The postinstall script used local AI CLIs (Claude, Gemini, Q) to find secrets and pushed them to public s1ngularity-repository repos. A second phase used stolen GitHub tokens to make 5,500+ private repos public.
Why this severity: Supply-chain compromise; credential theft; mass repo exposure
- Started
- Aug 26, 2025
- Closed
- Aug 29, 2025
Affected
- nx 20.9.0-20.12.0, 21.5.0-21.8.0
- @nx/devkit, @nx/js, @nx/workspace, @nx/node 20.9.0 / 21.5.0
- @nx/eslint 21.5.0
- @nx/key, @nx/enterprise-cloud 3.2.0
Fixed in
- Malicious versions removed from npm (see GHSA-cxm3-wv7p-598c)
Timeline5
Second phase: 5,500+ private repos of 400+ users/orgs made public with stolen tokens
SourceGitHub disables attacker-created s1ngularity repositories (09:00 UTC)
SourceMalicious nx 21.5.0 and others published; npm removes them and revokes tokens that evening
SourceAttacker exploits the workflow and exfiltrates the npm token
SourceA PR adds a GitHub Actions workflow with an injection bug to nrwl/nx
Source
Advisories1
News & write-ups4
- S1ngularity - What Happened, How We Responded, What We LearnedNx · Write-up
- s1ngularity: supply chain attack leaks secrets on GitHubWiz · Aug 27, 2025 · Write-up
- Weaponizing AI Coding Agents for Malware in the Nx Malicious Package Security IncidentSnyk · Write-up
- Nx npm Packages Compromised in Supply Chain Attack Weaponizing AI CLI ToolsSocket · Write-up
Get an email when a new major security incident drops. No spam, unsubscribe any time.
