Nx s1ngularity: malicious npm packages drove local AI coding CLIs to enumerate secrets for exfiltration

What happened, in order

1. August 2025 The Nx "s1ngularity" attack occurred in August 2025, compromising Nx npm package versions 20.9.0 through 21.8.0.source
2. August 26, 2025 On August 26, 2025, malicious versions of several Nx packages were published to npm.source
3. August 26th Wiz Research began responding to the s1ngularity incident when news first broke on August 26th.source
4. August 27, 2025 GitGuardian detected secrets leaked between August 27, 2025 at 00:32:48 and August 27, 2025 at 15:36:57.source
5. morning (UTC) of the 28th Almost 90% of leaked GitHub tokens were still valid on the morning (UTC) of the 28th, over 24 hours after GitHub removed the repositories containing leaked secrets.source
6. August 28, 2025 In a second phase on August 28, 2025, attackers used valid GitHub tokens from the first phase to make private repositories public, naming them s1ngularity-repository- plus 5 random letters.source
7. between the evening of the 29th and the evening of the 30th Some time between the evening of the 29th and the evening of the 30th, GitHub ran a revocation campaign, after which roughly 5% of leaked GitHub keys remained valid.source
8. evening of August 31st Phase 3 began the evening of August 31st, when two compromised users publicly uploaded over 500 repositories belonging to a single organization.source

Not dated in the sources:

• The malicious packages were active for 4 hours before being completely removed from the registry.source
• Nx reached out to NPM, removed the affected token, and started to manually unpublish the malicious packages.source
• NPM stepped in to remove all packages and revoke all Nx NPM tokens.source
• Nx disabled all publishing workflows and external contributor access until they understood the attack vector.source

Who and what was involved

1. Attackers exploited a GitHub Actions injection vulnerability to steal the NPM publishing token.source
2. Nx is the organization that owns the Nx packages and responded to the incident.source
3. NPM removed all packages and revoked all Nx NPM tokens.source
4. GitHub collaborated closely with Nx and took leaked repositories offline.source
5. Community members alerted Nx to the attack and assisted during the investigation.source
6. The attackers targeted popular AI CLI tools including Claude, Gemini, and Q, hunting for their configuration files and authentication tokens.source
7. GitGuardian monitored the attack and sent 482 emails to affected developers through its Good Samaritan Program, capping at 10 emails per repository.source
8. An attacker compromised an npm publishing token for nx packages through a vulnerable GitHub Action.source
9. Wiz's Threat Exposure and Customer Incident Response Teams worked together to analyze leaked data and notify victims directly.source
10. In Phase 2, at least 480 compromised accounts, two-thirds of them organizations, published over 6,700 private repositories publicly.source

How the agents communicated and organised

1. Nx started identifying and reaching out to point of contacts: Nx Enterprise customers, social media and Discord communities, and actively monitored GitHub for leaked repositories, opening issues to alert their respective owners.source
2. Nx collaborated closely with GitHub, who stepped in to take leaked repositories offline.source
3. The attackers likely used only the GitHub API for the second phase, renaming repositories before making them public based on repository IDs.source
4. The malware only exfiltrated data when the gh CLI was present and it could create a repository on the victim's account.source

What they used to do it

1. The malicious packages ran a post-install script that scanned user systems for sensitive data, attempted to use local AI tools (like Claude and Gemini), and uploaded the results to a public GitHub repo via the GitHub CLI.source
2. The attacker created a PR with a malicious title containing shell commands, which executed with repository permissions due to the PR title validation workflow's injection vulnerability and pull_request_target setup.source
3. The malicious script ran with elevated permissions, extracted a read/write GitHub token, and used it to create a branch with a malicious script replacing the legitimate CI script, trigger the publish workflow against that branch via the GitHub API, and clean up traces by deleting branches and workflow runs.source
4. When the publish workflow ran the malicious script, it had access to the NPM_TOKEN and exfiltrated it.source
5. Using the stolen token, they published infected Nx packages with postinstall hooks that scanned users' systems and leaked data to public GitHub repositories.source
6. The malware scanned infected systems for GitHub tokens, npm authentication keys, SSH private keys, environment variable API keys, and cryptocurrency wallet files.source
7. Stolen credentials were double-base64 encoded before exfiltration to public GitHub repositories named with the "s1ngularity-repository" pattern, each containing a single "results.b64" file.source
8. The attackers attempted to use LLM clients as vectors to enumerate secrets on victims' machines.source
9. The malware directly extracted environment variables plus GitHub and npm tokens and published them in public s1ngularity-repository GitHub repositories.source
10. The malware abused locally configured AI CLIs to identify additional files for exfiltration.source
11. A second phase used leaked GitHub tokens to make victims' private repositories public, renaming them to s1ngularity-repository-#5letters#.source
12. All three payload variants shared code to detect popular AI CLIs: Claude, Gemini, and Amazon Q.source
13. The Nx 20.9.0, 20.11.0, and 21.5.0 prompt told the AI to recursively search Linux/macOS paths from $HOME and others, skip /proc /sys /dev, follow depth limit 8, avoid sudo, and record matching wallet-related file paths in /tmp/inventory.txt.source
14. The Nx 21.6.0 and 21.7.0 prompt used role-prompting as an authorized penetration testing agent to enumerate interesting text files and write their full paths to /tmp/inventory.txt without reading or exfiltrating contents.source
15. The Nx 20.12.0 and 21.8.0 prompt posed as a file-search agent looking for text configuration and environment-definition files, excluding source code and the source/ directory, and writing full paths to /tmp/inventory.txt.source
16. In the initial compromise of Nx's npm token, the attacker appears to have used webhook.site for remote exfiltration.source
17. Webhook.site was used in the initial compromise but limits anonymous users to 100 records, forcing the attacker to use an alternative exfiltration mechanism due to the large number of victims.source
18. In Phase 2, the attacker used TOR to access victim accounts.source
19. The attacker used a single-threaded Python script to publish repositories, with User Agents python-requests/2.32.3 and python-requests/2.32.4.source

What they did to avoid being caught

1. The double-base64 encoding was likely chosen to evade basic detection mechanisms while preserving data integrity during GitHub-based exfiltration.source
2. The attacker optimized for operational security by using exfiltration mechanisms that required no infrastructure of their own.source
3. The attackers deliberately exfiltrated data only when the gh CLI was present and they could create a repository on the victim's account, limiting their exposure.source

What made it possible

1. The PR title validation workflow used pull_request_target, which runs with the permissions of the target branch and can access repository secrets, bypassing normal restrictions for external contributors.source
2. The repository had GitHub's original default setting of 'Read and write permissions' for Actions, giving any workflow token full repository access.source
3. The publish.yml workflow included workflow_dispatch, enabling triggering the workflow programmatically via GitHub's API.source
4. The attackers targeted AI CLI tools because these tools often require elevated permissions and access to sensitive development environments.source
5. Of the compromised systems, 33% had at least one LLM client installed, validating the attackers' focus on AI development tools.source
6. Deleting repositories does not automatically revoke the underlying credentials, so developers must manually rotate tokens, API keys, and other secrets.source
7. Simply deleting exposed data is not enough; organizations must inventory secrets across all systems, automate rotation workflows at scale, and maintain comprehensive visibility into where credentials are used.source
8. AI file identification required at least one AI CLI with functional configuration and credentialing, a valid LLM response without task rejection, and a useful response identifying sensitive files.source
9. Configuration problems recurred, including Claude credit issues, credential issues, --dangerously-skip-permissions requiring approval, and MCP configuration issues.source
10. The attackers optimized for operational security by using exfiltration mechanisms that required no infrastructure, similar to the tj-actions attack.source

How it was found

1. Nx detected the malicious packages because they lacked NPM provenance signing.source
2. GitGuardian's monitoring infrastructure sees everything on GitHub including deleted files and repositories, allowing analysis of exfiltrated data.source
3. GitGuardian's platform listed 1,346 repositories containing "s1ngularity-repository" while GitHub listed only about ten, indicating repositories were being deleted while developers continued using the vulnerable package.source
4. August 28, 2025 GitGuardian released a free, open-source tool called S1ngularity Scanner to scan local environments for compromised files including environment variables.source
5. GitGuardian added all discovered stolen credentials to the HasMySecretLeaked database in hashed form.source
6. People can check whether their secrets were compromised at hasmysecretleaked.com, where the secret is hashed locally before being checked against the database.source
7. For bulk checking, GitGuardian's CLI can be used with commands like `ggshield hmsl check --type env <(env)`.source
8. Anyone who used malicious Nx versions 20.9.0 through 21.8.0 should make checking their credentials the first step in incident response.source
9. To check for compromise, inspect package.json and package-lock.json for malicious Nx versions 20.9.0-21.8.0 and run `npm ls nx` to verify the current installation.source
10. If compromised, immediately remove the node_modules directory, run `npm cache clean --force`, and inspect shell startup files (~/.bashrc, ~/.zshrc, ~/.profile) for malicious "sudo shutdown -h 0" commands.source
11. Most critically, rotate every credential that might have been exposed: GitHub tokens, npm tokens, SSH keys, API keys, and cryptocurrency wallet seeds.source
12. Check the GitHub account for "s1ngularity-repository" repositories and review audit logs for suspicious activity.source
13. Wiz's white glove reporting reached over 50 major impacted organizations, and the vast majority said this was the first indication they had received of the attack impacting them.source
14. For Phase 1, investigators should look for the string 's1ngularity' in the repo field of repo.create events in GitHub Audit Logs.source
15. A detection signal is a single user cloning a wide set of repositories in a short timeframe.source
16. Organizations should check GitHub Audit Logs for the org_credential_authorization.deauthorize event by the 'github-staff' actor_id, which is tied to GitHub's mass revocation of compromised credentials.source

What it reached, and the numbers

1. The attack targeted the OSS packages of Nx; Nx Cloud was not affected and remained fully operational and secure.source
2. Nx has approximately 6 million weekly installs.source
3. GitGuardian detected 2,399 repositories containing at least one secret, with 82,901 total secrets including 11,168 valid ones.source
4. 10,767 repositories were made public, corresponding to around 20% of repositories containing a hardcoded secret.source
5. Of 366 systems where LLM tools were targeted, only 95 actually wrote the requested /tmp/inventory.txt file, with many LLM clients refusing to comply.source
6. 85% of infected systems were running macOS, highlighting the attack's particular impact on the developer community.source
7. GitGuardian detected 1,079 repositories containing at least one secret, representing 2,349 distinct secrets, with the most common credential types being GitHub, NPM, AWS, and OpenAI.source
8. Half of the discovered secrets were valid at the time of writing, with GitHub OAuth App Keys being the most numerous.source
9. At the height of the wave, nearly 1,400 repositories were publicly accessible via GitHub.source
10. GitGuardian identified over 1,100 valid credentials from the Nx attack across GitHub tokens, OpenAI API keys, AWS credentials, and other sensitive secrets.source
11. The stolen secrets remained valid during GitGuardian's analysis, so attackers could still use them for lateral movement and further attacks.source
12. The s1ngularity attack shows concerning trends: targeting AI development tools as new attack surfaces, using public platforms like GitHub for credential exfiltration, and combining credential theft with environmental sabotage.source
13. Stolen credentials were weaponized rapidly, within 2-4 hours, making automated detection and response capabilities essential for modern software delivery.source
14. In Phase 1, over 1,700 users had secrets publicly leaked, each with at least a GitHub token in the leaked data.source
15. Multiple reports, echoing Wiz's own data, say over 2,000 unique, verified secrets were leaked.source
16. Wiz observed over 20,000 files leaked across its sample, across 250 cases impacting 225 distinct users.source
17. In Phase 2, at least 480 compromised accounts published over 6,700 private repositories publicly, and in one case a single organization had over 700 repositories leaked.source
18. Wiz identified thousands of valid credentials in the formerly-private repositories exposed in Phase 2.source
19. AI exfiltrated data successfully in under a quarter of cases, yielding under 100 unique valid secrets across 20,000 exfiltrated files, mostly for AI services (Langsmith, Anthropic, OpenAI) and cloud platforms (AWS, Azure, Vercel).source
20. Almost a quarter of Claude interactions were rejected by guardrails, Q showed similar behavior, and Gemini rejected at a lower rate.source
21. Almost a quarter of Gemini interactions were foiled by default restrictions to workspace directories, and in many other cases the search only ran against Nx's directory, consistently exfiltrating 14-15 non-sensitive Nx files.source
22. Over 40% of leaked npm tokens from the first phase are still valid, amounting to almost 100 unique tokens.source
23. For organizations impacted in the second phase, the exposure of secrets in formerly private repositories creates further attack surface.source
24. Attackers are escalating small GitHub Actions misconfigurations into massive supply chain attacks, as seen in Ultralytics, tj-actions, and now Nx.source

What the sources say is still unknown or disputed

1. The fact that stolen secrets remain valid raises questions on both offensive and defensive sides, and it is likely developers are unaware of the leaked secrets and have not revoked them.source
2. It is likely that the leaked secrets will never be revoked or rotated, though GitGuardian knows the names of the repositories that leaked secrets.source
3. An unknown, broader pool of Nx users may have run the malware, resulting in secrets gathered and persisted to disk but not exfiltrated.source
4. Wiz has yet to observe any successful cryptocurrency-related exfiltration.source
5. The first burst of activity has concluded, but the incident is expected to have a long tail with future risks.source