# s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed · pwn.watch > Attackers abused a GitHub Actions injection bug in nrwl/nx to steal its npm token and published malicious nx and @nx/* versions for about four hours. The postinstall script used local AI CLIs (Claude, Gemini, Q) to find secrets and pushed them to public s1ngularity-repository repos. A second phase used stolen GitHub tokens to make 5,500+ private repos public. Page: https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025 · generated 2026-10-22T23:13:41.393Z ## Status - Severity: critical · status: closed · patch: patched - Product: nx and @nx/* npm packages - Started: 2025-08-26 · closed: 2025-08-29 - Affected: nx 20.9.0-20.12.0, 21.5.0-21.8.0; @nx/devkit, @nx/js, @nx/workspace, @nx/node 20.9.0 / 21.5.0; @nx/eslint 21.5.0; @nx/key, @nx/enterprise-cloud 3.2.0 - Fixed in: Malicious versions removed from npm (see GHSA-cxm3-wv7p-598c) ## Follow this incident - RSS (one item per update): https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025/feed.xml - JSON Feed: https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025.json - This file: https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025/llms.txt ## Updates (newest first) - 2025-08-28/29: Second phase: 5,500+ private repos of 400+ users/orgs made public with stolen tokens (https://www.wiz.io/blog/s1ngularity-supply-chain-attack) - 2025-08-27: GitHub disables attacker-created s1ngularity repositories (09:00 UTC) (https://www.wiz.io/blog/s1ngularity-supply-chain-attack) - 2025-08-26: Malicious nx 21.5.0 and others published; npm removes them and revokes tokens that evening (https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c) - 2025-08-24: Attacker exploits the workflow and exfiltrates the npm token (https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c) - 2025-08-21: A PR adds a GitHub Actions workflow with an injection bug to nrwl/nx (https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c) ## Fix brief # Security brief: s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed Source: https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025 · status: closed (closed Aug 29, 2025) · severity: critical · updated Aug 29, 2025 ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is Attackers abused a GitHub Actions injection bug in nrwl/nx to steal its npm token and published malicious nx and @nx/* versions for about four hours. The postinstall script used local AI CLIs (Claude, Gemini, Q) to find secrets and pushed them to public s1ngularity-repository repos. A second phase used stolen GitHub tokens to make 5,500+ private repos public. Severity detail: Supply-chain compromise; credential theft; mass repo exposure - Product: nx and @nx/* npm packages ## Affected versions - nx 20.9.0-20.12.0, 21.5.0-21.8.0 - @nx/devkit, @nx/js, @nx/workspace, @nx/node 20.9.0 / 21.5.0 - @nx/eslint 21.5.0 - @nx/key, @nx/enterprise-cloud 3.2.0 ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - Malicious versions removed from npm (see GHSA-cxm3-wv7p-598c) After upgrading, re-run the checks above and redeploy/restart the affected services. ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Latest updates - Aug 28/29, 2025: Second phase: 5,500+ private repos of 400+ users/orgs made public with stolen tokens - Aug 27, 2025: GitHub disables attacker-created s1ngularity repositories (09:00 UTC) - Aug 26, 2025: Malicious nx 21.5.0 and others published; npm removes them and revokes tokens that evening - Aug 24, 2025: Attacker exploits the workflow and exfiltrates the npm token - Aug 21, 2025: A PR adds a GitHub Actions workflow with an injection bug to nrwl/nx ## Advisories - [Malicious versions of Nx and some supporting plugins were published (GHSA-cxm3-wv7p-598c)](https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c) (Nx / GitHub) ## Write-ups & news - [S1ngularity - What Happened, How We Responded, What We Learned](https://nx.dev/blog/s1ngularity-postmortem) - [s1ngularity: supply chain attack leaks secrets on GitHub](https://www.wiz.io/blog/s1ngularity-supply-chain-attack) - [Weaponizing AI Coding Agents for Malware in the Nx Malicious Package Security Incident](https://snyk.io/blog/weaponizing-ai-coding-agents-for-malware-in-the-nx-malicious-package/) - [Nx npm Packages Compromised in Supply Chain Attack Weaponizing AI CLI Tools](https://socket.dev/blog/nx-packages-compromised) --- Machine-readable: https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.