{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T16:42:00.965Z",
  "tag": {
    "id": "nx",
    "label": "Nx",
    "isStack": false,
    "url": "https://pwn.watch/t/nx",
    "feed": "https://pwn.watch/t/nx/feed.xml"
  },
  "counts": {
    "incidents": 2,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 2
  },
  "incidents": [
    {
      "slug": "nx-nx-console-cve-2026-48027",
      "title": "Nx Nx Console: Nx Console Embedded Malicious Code Vulnerability",
      "url": "https://pwn.watch/i/nx-nx-console-cve-2026-48027",
      "json": "https://pwn.watch/i/nx-nx-console-cve-2026-48027.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Nx Nx Console",
      "tags": [
        "node",
        "devtools",
        "nx",
        "supply-chain",
        "ransomware",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2026-48027"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-05-27",
      "closedAt": "2026-05-27",
      "updatedAt": "2026-05-27",
      "summary": "Nx Console contains an embedded malicious code vulnerability that allowed a malicious version of Nx Console to be published. The compromised extension fetched an obfuscated payload that could harvested credentials from multiple sources on disk and in memory. Added to CISA KEV on 2026-05-27.",
      "xPost": null
    },
    {
      "slug": "nx-s1ngularity-npm-supply-chain-august-2025",
      "title": "s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed",
      "url": "https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025",
      "json": "https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "nx and @nx/* npm packages",
      "tags": [
        "npm",
        "node",
        "github-actions",
        "ai",
        "nx",
        "s1ngularity",
        "github",
        "supply-chain",
        "infostealer"
      ],
      "cveIds": [],
      "affectedVersions": [
        "nx 20.9.0-20.12.0, 21.5.0-21.8.0",
        "@nx/devkit, @nx/js, @nx/workspace, @nx/node 20.9.0 / 21.5.0",
        "@nx/eslint 21.5.0",
        "@nx/key, @nx/enterprise-cloud 3.2.0"
      ],
      "fixedVersions": [
        "Malicious versions removed from npm (see GHSA-cxm3-wv7p-598c)"
      ],
      "startedAt": "2025-08-26",
      "closedAt": "2025-08-29",
      "updatedAt": "2025-08-29",
      "summary": "Attackers abused a GitHub Actions injection bug in nrwl/nx to steal its npm token and published malicious nx and @nx/* versions for about four hours. The postinstall script used local AI CLIs (Claude, Gemini, Q) to find secrets and pushed them to public s1ngularity-repository repos. A second phase used stolen GitHub tokens to make 5,500+ private repos public.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "nx-nx-console-cve-2026-48027",
      "incidentTitle": "Nx Nx Console: Nx Console Embedded Malicious Code Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-05-27",
      "title": "CISA added CVE-2026-48027 to the KEV catalog (due 2026-06-10).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/nx-nx-console-cve-2026-48027"
    },
    {
      "incident": "nx-s1ngularity-npm-supply-chain-august-2025",
      "incidentTitle": "s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-08-28/29",
      "title": "Second phase: 5,500+ private repos of 400+ users/orgs made public with stolen tokens",
      "body": null,
      "sourceUrl": "https://www.wiz.io/blog/s1ngularity-supply-chain-attack",
      "url": "https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025"
    },
    {
      "incident": "nx-s1ngularity-npm-supply-chain-august-2025",
      "incidentTitle": "s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-08-27",
      "title": "GitHub disables attacker-created s1ngularity repositories (09:00 UTC)",
      "body": null,
      "sourceUrl": "https://www.wiz.io/blog/s1ngularity-supply-chain-attack",
      "url": "https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025"
    },
    {
      "incident": "nx-s1ngularity-npm-supply-chain-august-2025",
      "incidentTitle": "s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-08-26",
      "title": "Malicious nx 21.5.0 and others published; npm removes them and revokes tokens that evening",
      "body": null,
      "sourceUrl": "https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c",
      "url": "https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025"
    },
    {
      "incident": "nx-s1ngularity-npm-supply-chain-august-2025",
      "incidentTitle": "s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-08-24",
      "title": "Attacker exploits the workflow and exfiltrates the npm token",
      "body": null,
      "sourceUrl": "https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c",
      "url": "https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025"
    },
    {
      "incident": "nx-s1ngularity-npm-supply-chain-august-2025",
      "incidentTitle": "s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-08-21",
      "title": "A PR adds a GitHub Actions workflow with an injection bug to nrwl/nx",
      "body": null,
      "sourceUrl": "https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c",
      "url": "https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025"
    }
  ]
}