s1ngularity
Security incidents tagged s1ngularity. Newest first.
0 s1ngularity incidents in the last 12 months
Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore
- Incidents
- 1
- Live
- 0
- Patched
- 1
- Days without an incident
- 420
- Longest quiet run: 421 days (Aug 29–Oct 23)
Show 1 older incident1 older incident
August 2025 1
- Patched
s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed
Attackers abused a GitHub Actions injection bug in nrwl/nx to steal its npm token and published malicious nx and @nx/* versions for about four hours. The postinstall script used local AI CLIs (Claude, Gemini, Q) to find secrets and pushed them to public s1ngularity-repository repos. A second phase used stolen GitHub tokens to make 5,500+ private repos public.
nx and @nx/* npm packagesClosed Aug 29, 2025
