# PIR-2026-0035 - s1ngularity: Nx supply-chain attack weaponizes victims' local AI coding agents for credential theft

- `id`: PIR-2026-0035
- `title`: Trojanized Nx npm packages run victims' own AI CLIs (Claude Code, Gemini CLI, Amazon Q) with safety flags disabled to hunt secrets; 2,349 secrets leaked, 6,700+ private repos later exposed
- `date_occurred`: 2025-08-26 to 2025-08-27 (malicious versions live on npm); second wave ~2025-08-28+ (stolen tokens used to publish victims' private repos)
- `date_detected`: 2025-08-26/27 (community + security-firm detection within hours; npm takedown)
- `date_disclosed`: 2025-08-27 onward (Nx advisory; Wiz, Semgrep, GitGuardian, broad press within days)
- `status`: corroborated (multi-firm forensics on public exfil artifacts + vendor postmortem)

### The agent
- `agent_description`: Victims' locally installed AI coding CLIs - Claude Code, Gemini CLI, Amazon Q - invoked by malware as reconnaissance tools. The agents were not compromised; they were handed to the attacker by a postinstall script in trojanized versions of Nx, a very widely used build system.
- `operator_type`: enterprise + individual (thousands of developer machines and CI environments)
- `autonomy_level`: fully-autonomous during the attack window (invoked with `--dangerously-skip-permissions`, `--yolo`, `--trust-all-tools`)
- `model_stack`: Claude, Gemini, Amazon Q via victims' own authenticated CLIs
- `harness`: attacker-controlled prompt driving stock CLIs from a malicious npm postinstall (telemetry.js; Linux/macOS)

### Authority
- `authority_scope`: code execution and file access as the developer user; credentials (GitHub/npm tokens, SSH keys, cloud + AI API keys, .env files); funds (crypto wallets on dev machines)
- `funds_at_risk_usd`: unknown (wallets targeted; no aggregate figure)
- `blast_radius`: customers/third parties (Nx's install base; second-order: 480+ GitHub accounts, two-thirds organizations, had 6,700+ private repos published)

### The failure
- `root_cause`: supply-chain-compromise - primary (v0.1 taxonomy); contributing: credential-exposure (stolen npm publishing token via a vulnerable GitHub Actions workflow) and adversarial-other (weaponizing local agents)
- `failure_locus`: dependency (npm package); the agent layer was the attacker's tool, not the failing component
- `exploitation_status`: in-wild-exploited
- `mechanism`: Attackers exploited a vulnerable GitHub Actions workflow in the Nx repo to steal npm publishing tokens and pushed 8 trojanized Nx versions on 2025-08-26. The postinstall malware ran victims' own AI CLIs with safety flags disabled, prompting them to recursively hunt for crypto wallets, SSH keys, npm/GitHub tokens, and env files - the first documented supply-chain attack weaponizing local LLM agents for recon. Results were exfiltrated to attacker-created public GitHub repos ("s1ngularity-repository..."; 1,346 detected by GitGuardian), leaking 2,349 distinct secrets, mostly GitHub tokens (90% of 1,000+ still valid at analysis). In a second wave, stolen tokens were used to flip 6,700+ private repos public across 480+ accounts before GitHub disabled them.
- `adversary_present`: yes

### Impact
- `severity`: loss (realized: mass credential compromise + confidential source-code exposure; conservative because no dollar figure exists)
- `direct_loss_usd`: unknown (no attributed monetary theft published)
- `indirect_loss_usd`: unknown (fleet-wide secret rotation and IR across hundreds of orgs)
- `downtime`: n/a
- `data_exposure`: 2,349 distinct secrets (GitHub OAuth/PATs, cloud + AI API keys, npm tokens); contents of 6,700+ private repositories
- `controls_that_worked`: npm removed malicious versions within hours; GitHub disabled attacker exfil repos and the force-publicized repos; notably, the agents' own safety behavior was partially bypassed by design flags - refusal was not a reliable control once `--yolo`-class flags existed

### Detection and recovery
- `detected_by`: third-party (community + security firms, within hours of publication)
- `time_to_detect`: hours
- `time_to_recover`: days-weeks (takedowns in hours; token rotation and repo remediation across victims took far longer; 90%-valid tokens show rotation lagged)
- `remediation`: npm/GitHub takedowns; Nx advisory + token rotation; victim-side secret rotation; multi-firm IOC publication
- `structural_fix`: Nx hardened publishing (trusted publishing/workflow fixes); ecosystem-level: the `--dangerously-skip-permissions`-class flags that made agents weaponizable remain available in shipped CLIs

### Evidence
- `telemetry_grade`: append-only in effect (exfiltrated data landed in public GitHub repos and was independently captured and analyzed by multiple firms before takedown)
- `sources`:
  - https://www.wiz.io/blog/s1ngularity-supply-chain-attack (primary forensics)
  - https://www.wiz.io/blog/s1ngularitys-aftermath (primary forensics, second wave)
  - https://thehackernews.com/2025/08/malicious-nx-packages-in-s1ngularity.html
  - https://www.securityweek.com/hackers-target-popular-nx-build-system-in-first-ai-weaponized-supply-chain-attack/
  - https://orca.security/resources/blog/s1ngularity-supply-chain-attack/
  - All five URLs verified resolving 2026-08-15.
  - `independence`: strong - Wiz, GitGuardian, and press counts align; vendor (Nx) postmortem consistent.
- `aiid_incident_id`: 1210 (https://incidentdatabase.ai/cite/1210/) - cross-reference; primaries verified independently
- `confidence`: high (figures 2,349 / 1,346 / 480+ / 6,700+ verified across independent analyses; weakest link: realized downstream monetization of stolen secrets never measured)

### Verification notes (corrections applied)
1. Root cause reclassified from `adversarial-other` to `supply-chain-compromise` per v0.1 amendment 2 (Nx is one of the named motivating cases). All dates, counts, and mechanism verified as candidate stated: 2,349 secrets (The Hacker News/GitGuardian), 6,700+ private repos across 480+ accounts (Wiz aftermath analysis), AI-CLI flags confirmed verbatim.

### Corrections

- 2026-08-19: Added `aiid_incident_id` cross-reference (AIID 1210), matched against the AIID weekly database export (2026-08-17). A cross-reference, not a re-verification; no claim changed.