Incident Overview
On August 26, 2025, malicious versions of the Nx build system were published to the npm registry. These compromised packages—versions 20.9.0, 20.10.0, 20.11.0, 20.12.0, 21.5.0, 21.6.0, 21.7.0, and 21.8.0—contained a post-installation script designed to exfiltrate sensitive developer assets. The attack marked the first known supply-chain incident to weaponize local AI coding assistants, specifically targeting tools like Claude, Gemini, and Q CLI. The malware scanned victims’ machines for credentials, cryptocurrency wallets, SSH keys, and environment variables, then uploaded the results to attacker-controlled GitHub repositories under names like s1ngularity-repository, s1ngularity-repository-0, or s1ngularity-repository-1.
The attack unfolded in two phases. In the first phase, the malware executed on Linux and macOS systems, leveraging AI CLI tools with dangerous flags (e.g., --dangerously-skip-permissions, --yolo, --trust-all-tools) to bypass guardrails and extract filesystem contents. Exfiltrated data was double or triple base64-encoded and uploaded to public repositories, which GitHub disabled on August 27, 2025, after an 8-hour exposure window. By August 29, 2025, a second wave emerged: attackers used stolen GitHub tokens to make over 5,500 private repositories public, impacting approximately 400 users or organizations.
The compromised packages also modified shell configurations (.zshrc, .bashrc) to append sudo shutdown -h 0, forcing system shutdowns upon terminal launch—a tactic likely intended to disrupt forensic analysis. The malware persisted even after GitHub removed the repositories, as locally installed versions could still execute. Affected systems included not only direct Nx users but also those with the Nx VSCode extension (versions 18.6.30 to 18.65.1) or transitive dependencies in build pipelines.
Nx and GitHub responded swiftly: Nx revoked compromised tokens, hardened publishing workflows, and removed malicious versions from npm by August 27, 2025. GitHub disabled attacker-controlled repositories and monitored for further unauthorized access. However, the incident highlighted critical vulnerabilities in CI/CD workflows and the risks of unsanitized input in pull request titles combined with elevated permissions in GitHub Actions.
Possible Root Cause
The attack originated from a flawed GitHub Actions workflow in the Nx repository. The workflow used the pull_request_target trigger, which grants the GITHUB_TOKEN elevated permissions—including read/write access to the repository—unlike the standard pull_request trigger. This allowed an attacker to exploit a code injection vulnerability: unsanitized pull request titles could execute arbitrary commands. For example, a malicious PR title like $(echo "You've been compromised") would trigger command execution within the workflow.
The vulnerable workflow was initially designed to validate PR titles but failed to account for command injection risks. Although the workflow was removed from the master branch shortly after the vulnerability was identified, it persisted in older branches. An attacker exploited this by submitting a PR targeting an outdated branch containing the vulnerable workflow. Using the elevated GITHUB_TOKEN, the attacker triggered the publish.yml workflow, which had access to the npm token stored as a GitHub secret. The malicious commit then modified the publish.yml pipeline to send the npm token to an external webhook, enabling the publication of malicious Nx versions.
The root cause was compounded by two factors: (1) the use of pull_request_target without proper input sanitization, and (2) the workflow’s access to sensitive secrets via GitHub Actions. While the master branch had branch protection rules preventing direct writes, the attacker bypassed these by targeting an older branch.
Technical and Operational Lessons
- Supply Chain Risks in AI-Assisted Development: The incident demonstrated how local AI coding assistants (Claude, Gemini, Q CLI) can be weaponized for reconnaissance. Attackers exploited trusted tools by bypassing guardrails with dangerous flags, highlighting the need for stricter permissions and audit logging in AI-assisted workflows.
- GitHub Actions Misconfigurations: The use of pull_request_target with elevated GITHUB_TOKEN permissions created a critical attack surface. This incident reinforces the principle of least privilege: workflows should avoid unnecessary read/write access. Organizations should audit their GitHub Actions workflows for similar misconfigurations, particularly those using triggers like pull_request_target, workflow_dispatch, or repository_dispatch.
- Input Sanitization in CI/CD: The vulnerability stemmed from unsanitized pull request titles enabling command injection. Developers must implement robust input validation in workflows, especially those processing user-provided data.
- Transitive Dependency Risks: The malware spread beyond direct Nx users through transitive dependencies, VSCode extensions, and build pipelines. Organizations should adopt tools like Software Bill of Materials (SBOM) generators to track dependencies and detect malicious packages.
- Credential and Secret Hygiene: The attack exfiltrated GitHub tokens, npm credentials, SSH keys, and cryptocurrency wallets, emphasizing the need for proactive secret rotation. Organizations should enforce short-lived credentials, use secrets managers (e.g., GitHub Secrets, HashiCorp Vault), and monitor for anomalous API usage. The incident also highlighted the importance of revoking compromised tokens immediately and auditing audit logs for unauthorized repository changes.
- Malware Persistence and Forensic Challenges: The malware modified shell configurations to trigger system shutdowns, complicating incident response. Organizations should monitor for unexpected changes in .bashrc, .zshrc, and other startup files. Files like /tmp/inventory.txt (used to log scanned files) should be treated as indicators of compromise (IOCs).
Mitigation and Response Strategies
- Remove malicious Nx versions by deleting node_modules and clearing the npm cache (rm -rf node_modules && npm cache clean --force).
- Upgrade to a verified Nx release from npm, as all compromised versions have been removed.
- Check for attacker-created repositories (e.g., s1ngularity-repository) in GitHub accounts and revoke access to the compromised GitHub app (ID: 178c6fc778ccc68e1d6a).
- Rotate all GitHub tokens, npm tokens, SSH keys, and environment variables. For cryptocurrency wallets, transfer funds to new addresses immediately.
- Review .bashrc, .zshrc, and other shell configuration files for malicious entries (e.g., sudo shutdown -h 0).
- Delete /tmp/inventory.txt and related files if present, as they may contain logs of exfiltrated data.
- Audit GitHub audit logs for suspicious API activity, such as repository creations or unauthorized public exposure.
- Implement SBOM generation and dependency scanning to detect malicious packages in real time.
- Restrict GitHub Actions workflows to use the least privileged GITHUB_TOKEN permissions. Avoid triggers like pull_request_target unless absolutely necessary.
- Enforce branch protection rules to prevent unauthorized changes to critical branches, even in forks.
- Monitor CI/CD pipelines and developer endpoints for unexpected child processes or API calls to external domains.
- Educate developers on recognizing supply-chain risks, such as unusual package versions or unexpected repository creations.
It serves as a cautionary example of how compromised CI/CD workflows can lead to large-scale credential theft and data exposure. Organizations should treat supply-chain attacks as a high-priority risk, investing in tools and processes to detect and respond to such threats proactively. Collaboration between open-source maintainers, platform providers (GitHub, npm), and security researchers will be essential to mitigating future risks.
The weaponization of AI assistants in this attack also signals a shift in adversary tactics. As AI tools become more integrated into development workflows, defenders must anticipate their misuse and implement safeguards to prevent abuse. This includes monitoring AI tool interactions, logging dangerous flags, and enforcing strict permissions.