s1ngularity: hijacked Nx packages made AI CLIs hunt secrets

What happened

On 26 August 2025 malicious versions of Nx, a popular build system for JavaScript projects, and several of its plugins were published to npm. Nx believes the attackers obtained its npm publishing token two days earlier by exploiting a GitHub Actions workflow that could be made to run shell commands from a pull request title. The malicious versions were on the registry for about four hours before npm removed them; two smaller packages stayed up until the next morning.

The packages ran a post-install script on every machine that installed them. According to Nx, it searched the system for sensitive data, tried to use local AI tools, and uploaded the results to a new public repository under the victim’s own GitHub account, with “s1ngularity-repository” in its name. It also added a shutdown command to the user’s shell start-up files. Nx published a security advisory on 27 August and a post-mortem on 5 September 2025.

How AI was involved

Nx says the malware “attempted to use local AI tools (like Claude and Gemini)”. Socket, which analysed the packages, says the script tried to run three AI command-line tools, claude, gemini and q, in a way that needed no permission from the user, and asked them to list text and configuration files on the machine. The script then read the files those tools found and sent their contents with the rest of the stolen data.

The AI did one task, reconnaissance of the file system, on machines where developers already had these tools installed and signed in. Socket calls it one of the first publicly documented cases of malware using developer AI tools this way.

Impact

According to Socket, public data showed more than 1,000 GitHub accounts with attacker-created repositories holding exfiltrated credentials. Nx warned that users could be affected without using Nx in a project: versions of its Nx Console editor extension installed the latest nx package in the background while the malicious version was tagged as latest. Nx has not published a count of affected users. The record is rated severity 2: real credentials were exposed, but no source counts affected organisations.

Timeline

• 21 Aug 2025 Nx merges a workflow with an injection flaw.
• 24 Aug 2025 An attacker uses the flaw and likely obtains Nx’s npm token, according to the advisory.
• 26 Aug 2025 Malicious versions are published; npm removes them about four hours later.
• 27 Aug 2025 Nx publishes its security advisory; Socket publishes its analysis.
• 5 Sep 2025 Nx publishes its post-mortem.

What is not known

• Who the attackers are.
• How many organisations, as opposed to individual accounts, had credentials stolen, and whether those credentials were used afterwards.
• How many of the infected machines had an AI tool that actually ran the search.

Lessons for defenders

• AI tools signed in on a developer machine are reachable by any code that runs there, including install scripts. Treat any mode that lets them act without asking as a risk.
• Workflows triggered by pull requests from outside contributors must never run with write tokens or reach publishing secrets.
• Provenance signing helped Nx see that the packages did not come from its pipeline, but it did not stop installation. Registries and teams need to enforce it.
• Rotate GitHub, npm and other tokens on any machine that installed an affected version.