Nx s1ngularity attack: malicious npm packages turned local AI tools toward secret hunting

On 26 August 2025 attackers used a stolen npm publishing token to push malicious versions of the Nx build system and several of its plugins to the npm registry. The packages hunted for credentials on developer machines, tried to enlist locally installed AI command-line tools such as Claude and Gemini, and uploaded what they found to public GitHub repositories.

What happened

Nx traced the breach to a pull-request title validation workflow that echoed titles without sanitising them. An attacker opened a pull request whose title carried shell commands, and the chain that followed ended with the theft of the npm token used for publishing.

The poisoned releases carried a post-install script that scanned the file system, gathered credentials and published them to GitHub under the victim's own account. Nx also found that its Nx Console extension for VS Code, from version 18.6.30 to 18.65.1, installed the latest nx package on launch, so some developers were exposed without using Nx in any project.

Impact

The malicious versions were live for about four hours. Nx said that the ability to publish from its repository, combined with roughly 6 million weekly installs, gave the breach a very large potential reach. Stolen data sat in repositories whose names contained s1ngularity-repository, which GitHub began deactivating or archiving. Nx Cloud was not affected. A total count of affected developers has not been published.

Response

npm pulled the affected versions and revoked publish tokens, blocking further releases. Nx then dropped npm tokens in favour of Trusted Publisher, required approval for pipeline runs by all external contributors, and published a security advisory with a detailed timeline.

Lessons for security leaders

• AI command-line agents on developer laptops inherit that developer's file access. Malware can simply ask them to search, so their permission flags deserve policy.
• Prefer registry publishing through short-lived OIDC identities over long-lived tokens stored as CI secrets.
• Audit CI workflows for untrusted input such as pull-request titles reaching a shell, especially in workflows that run with write permissions.
• Editor extensions that install packages silently widen exposure; include them in software inventory and review.