Malicious Nx npm releases used local AI coding CLIs to hunt for secrets

Attackers abused a GitHub Actions injection flaw in the Nx repository to steal an npm publishing token, then published malicious versions of nx and several plugins on August 26, 2025. For about four hours, installs ran a script that searched machines for credentials, tried to use local AI tools such as Claude and Gemini to help, and uploaded the results to public GitHub repositories under the victims' own accounts.

Sources

• Primary: https://nx.dev/blog/s1ngularity-postmortem
• Upstream: Editorial
• Entered by the cybermap.lol editors, with sources on the entry