ManifoldAgent incident ledger
← Back to tableAll incidents timeline

Suggest a change

About Compromised Nx packages use installed AI CLIs to hunt secrets

Suggest a change to an entry, the methodology or the ledger as a whole: something to fix, correct or add. We read every suggestion, and check corrections against their sources.

Nx· Claude Code, Gemini CLI and Amazon Q CLI, as invoked by the malware

Compromised Nx packages use installed AI CLIs to hunt secrets

Malicious Nx versions on npm ran a postinstall script that prompted developers' installed AI CLIs, with permission checks switched off, to find secrets, then published the results to public GitHub repositories.

On 26 August 2025 an attacker used a stolen npm publish token to push malicious versions of nx and several @nx packages. The postinstall script looked for Claude Code, Gemini CLI and Amazon Q CLI on the machine and prompted them, with flags such as --dangerously-skip-permissions, --yolo and --trust-all-tools, to search the file system for credential and configuration files. Results were uploaded to public repositories on the victim's own GitHub account. The versions were live for about four hours. The Hacker News reported 2,349 distinct leaked secrets. Wiz later found that about half of affected victims had an AI CLI installed, that almost a quarter of Claude interactions were refused, and that the AI step exfiltrated data successfully in under a quarter of cases. A second wave used stolen GitHub tokens to make private repositories public.

Updated 19 Oct 2026

First incident action to disclosure
1 day
First incident action to discovery
0 days
Noticed first by
Someone else
Caught
The damage

What happened

  • First incident action
  • Unnoticed
  • Handler found out
  • Known, not public
  • Disclosed
  • Public

  1. 21 Aug 2025

    Vulnerable GitHub Actions workflow added to the Nx repo

    Reverted on main the next day, but an outdated branch was later used to steal the npm publish token.

  2. 26 Aug 2025

    First malicious Nx versions published to npm

    6:32 PM EDT; further versions follow until 8:42 PM EDT.

  3. 26 Aug 2025

    Community GitHub issue alerts the Nx team

    8:30 PM EDT.

  4. 26 Aug 2025

    npm removes the versions; Nx revokes publishing tokens

    Removal at 10:44 PM EDT, token revocation at 11:57 PM EDT.

  5. 26 Aug 2025

    First incident action

    First incident action

    First malicious versions published at 6:32 PM EDT.

  6. 26 Aug 2025

    Handler found out · 0 days in

    The handler finds out

    A GitHub issue alerting the Nx team was posted at 8:30 PM EDT.

  7. 27 Aug 2025

    Disclosed · 1 day after the first incident action

    Nx publishes security advisory GHSA-cxm3-wv7p-598c

    1:53 AM EDT.

  8. 27 Aug 2025

    GitHub disables the attacker-created repositories

    9 AM UTC, after an exposure window of about eight hours.

  9. 28 Aug 2025

    Second wave uses stolen GitHub tokens to make private repositories public

    Wiz reports 400+ users or organisations and 5,500+ private repositories affected.

    Reports differ

    Scale of the second wave.

    • Wiz: 400+ users or organisations, 5,500+ private repositories.
    • The Hacker News: 190+ users or organisations, 3,000+ repositories, from an earlier count.
    • Wiz's later count: at least 480 accounts, over 6,700 private repositories.

  10. 3 Sep 2025

    Wiz measures how often the AI CLI step worked

    Under a quarter of cases exfiltrated data; almost a quarter of Claude interactions were refused.

  11. 5 Sep 2025

    Nx publishes its postmortem

    Moves to Trusted Publisher with OIDC and manual two-factor approval.

Agent failures

Supply chain compromise, Hijacked by an attacker, Data exfiltrationShow
Map to frameworks

  • Supply chain compromise

    Malicious Nx versions on npm ran a postinstall script.

  • Hijacked by an attacker

    The script prompted installed AI CLIs, with permission checks off, to hunt for secrets.

  • Data exfiltration

    The secrets found were published to public GitHub repositories.

How it was found

Found first by someone else, from the damageShow
Found first by
Someone else
How
The damage
Found to disclosed
1 day

A community member opened a GitHub issue about two hours after the first malicious publish. The Nx postmortem says the packages were identifiable because they lacked npm provenance signing. On victim machines, the visible trace was new public repositories named s1ngularity-repository on their own GitHub accounts.

What is publicly known

7 of 12 fully publicShow
7 of 12 fully public
ItemPublic?DetailSources
PartialThe CLIs are named (Claude Code, Gemini CLI, Amazon Q CLI); the models and versions behind them on victim machines are not.
UnknownNo source mentions reasoning settings for the CLI runs.
KnownThe permission-skipping flags are published; Wiz measured provider refusals at almost a quarter of Claude interactions.
PartialThe malware's role-setting prompt is published; the CLIs' own built-in system prompts are not discussed.
KnownThe full prompt text is published in the advisory, and Wiz documents how it changed across versions.
KnownThe three CLIs, the non-interactive invocation and the flags used are stated plainly.
PartialResults left via public repositories on victims' own GitHub accounts; no source describes egress controls on the victim machines.
PartialWiz analysed outcomes from leaked repositories in aggregate; per-run CLI output or logs are not published.
KnownA community GitHub issue two hours after publish; missing provenance signing; new repositories on victim accounts.
Known2,349 secrets leaked; Wiz sample of 225 users; AI step exfiltrated data in under a quarter of cases.
KnownNx names a GitHub Actions injection that leaked the publish token; the flags explain why the CLIs acted without approval.
KnownNx moved to Trusted Publisher with manual 2FA approval and revoked tokens. No source reports changes by the AI CLI vendors.

Controls that apply

  • Govern

    Vet, pin and change-control what agents load

    The malicious nx and @nx versions lacked the npm provenance signing earlier releases had. A check that required it would have flagged them before install.

  • Identify

    Know every agent, its owner, its tools and its permissions

    Which developer machines had Claude Code, Gemini CLI or Amazon Q CLI installed for the malware to drive: Wiz found about half of affected victims did. A list of these tools would have told teams at once where the AI step could have run.

  • Protect

    Give agents their own scoped, short-lived credentials

    The AI CLIs searched the developer's file system with the developer's own access and found credential and configuration files: 2,349 distinct secrets in all, mostly GitHub tokens. Secrets kept out of reach of agent processes would have limited what the search turned up.

  • Give each agent the least agency its task needs

    The install script started the CLIs with --dangerously-skip-permissions, --yolo and --trust-all-tools. Installations where those permission-skipping modes were not available would have limited the search to what the tools' normal permission checks allowed.

  • Check each action against policy before it runs

    A check outside the CLI would have seen a package install script start an AI CLI with permission checks off and a prompt to hunt for credential files, and the upload of the results to a new public repository, and held both.

  • Detect

    Record every agent action, outside the agent

    A record of a package install script launching AI command-line tools with permission checks disabled, the file-system search for credential files that followed, and the creation of s1ngularity-repository on the victim's GitHub account.

  • Monitor every run and alert on what does not fit the task

    New public repositories named s1ngularity-repository appeared on developer accounts and stayed up for about eight hours until GitHub disabled them. An alert on public writes during a package install would have raised them within that window.

  • All controls →

Coverage and commentary

1 post on X, 2 statements, 1 articleShow
WWiz@wiz_io𝕏🚨 s1ngularity: a supply chain attack hiding in the Nx npm package Malicious versions stole GitHub tokens, SSH keys, wallets, and secrets, even hijacking AI CLI tools to help exfiltrate data. 📂 Thousands of secrets leaked into attacker-created public GitHub repos.27 Aug 2025♥ 46⟲ 119.3K viewsRead on X

What the parties involved said

  • Wiz Research

    The AI step worked less often than the framing suggests: under a quarter of cases exfiltrated data, and fewer than 100 unique valid secrets came from about 20,000 exfiltrated files.

  • Nx

    Moved publishing to npm Trusted Publisher with OIDC and required manual two-factor approval for releases.

All 5 sources

  1. Primary source

    Malicious versions of Nx and some supporting plugins were published (GHSA-cxm3-wv7p-598c) ↗Nx (GitHub Security Advisory) · 2025-08-27

  2. Primary source

    S1ngularity - What Happened, How We Responded, What We Learned ↗Nx · 2025-09-05

  3. Primary source

    s1ngularity's aftermath: analysis of Nx supply chain attack ↗Wiz · 2025-09-03

  4. Primary source

    s1ngularity: supply chain attack leaks secrets on GitHub: everything you need to know ↗Wiz · 2025-08-27

  5. Press

    Malicious Nx Packages in 's1ngularity' Attack Leaked 2,349 GitHub, Cloud, and AI Credentials ↗The Hacker News · 2025-08-28

Entry id nx-s1ngularity-ai-cli-2025 · overall Confirmed · impact major