PIR-2026-0035 - s1ngularity: Nx supply-chain attack weaponizes victims' local AI coding agents for credential theft

id: PIR-2026-0035
title: Trojanized Nx npm packages run victims' own AI CLIs (Claude Code, Gemini CLI, Amazon Q) with safety flags disabled to hunt secrets; 2,349 secrets leaked, 6,700+ private repos later exposed
date_occurred: 2025-08-26 to 2025-08-27 (malicious versions live on npm); second wave ~2025-08-28+ (stolen tokens used to publish victims' private repos)
date_detected: 2025-08-26/27 (community + security-firm detection within hours; npm takedown)
date_disclosed: 2025-08-27 onward (Nx advisory; Wiz, Semgrep, GitGuardian, broad press within days)
status: corroborated (multi-firm forensics on public exfil artifacts + vendor postmortem)

agent_description: Victims' locally installed AI coding CLIs - Claude Code, Gemini CLI, Amazon Q - invoked by malware as reconnaissance tools. The agents were not compromised; they were handed to the attacker by a postinstall script in trojanized versions of Nx, a very widely used build system.
operator_type: enterprise + individual (thousands of developer machines and CI environments)
autonomy_level: fully-autonomous during the attack window (invoked with --dangerously-skip-permissions, --yolo, --trust-all-tools)
model_stack: Claude, Gemini, Amazon Q via victims' own authenticated CLIs
harness: attacker-controlled prompt driving stock CLIs from a malicious npm postinstall (telemetry.js; Linux/macOS)

authority_scope: code execution and file access as the developer user; credentials (GitHub/npm tokens, SSH keys, cloud + AI API keys, .env files); funds (crypto wallets on dev machines)
funds_at_risk_usd: unknown (wallets targeted; no aggregate figure)
blast_radius: customers/third parties (Nx's install base; second-order: 480+ GitHub accounts, two-thirds organizations, had 6,700+ private repos published)

root_cause: supply-chain-compromise - primary (v0.1 taxonomy); contributing: credential-exposure (stolen npm publishing token via a vulnerable GitHub Actions workflow) and adversarial-other (weaponizing local agents)
failure_locus: dependency (npm package); the agent layer was the attacker's tool, not the failing component
exploitation_status: in-wild-exploited
mechanism: Attackers exploited a vulnerable GitHub Actions workflow in the Nx repo to steal npm publishing tokens and pushed 8 trojanized Nx versions on 2025-08-26. The postinstall malware ran victims' own AI CLIs with safety flags disabled, prompting them to recursively hunt for crypto wallets, SSH keys, npm/GitHub tokens, and env files - the first documented supply-chain attack weaponizing local LLM agents for recon. Results were exfiltrated to attacker-created public GitHub repos ("s1ngularity-repository..."; 1,346 detected by GitGuardian), leaking 2,349 distinct secrets, mostly GitHub tokens (90% of 1,000+ still valid at analysis). In a second wave, stolen tokens were used to flip 6,700+ private repos public across 480+ accounts before GitHub disabled them.
adversary_present: yes

severity: loss (realized: mass credential compromise + confidential source-code exposure; conservative because no dollar figure exists)
direct_loss_usd: unknown (no attributed monetary theft published)
indirect_loss_usd: unknown (fleet-wide secret rotation and IR across hundreds of orgs)
downtime: n/a
data_exposure: 2,349 distinct secrets (GitHub OAuth/PATs, cloud + AI API keys, npm tokens); contents of 6,700+ private repositories
controls_that_worked: npm removed malicious versions within hours; GitHub disabled attacker exfil repos and the force-publicized repos; notably, the agents' own safety behavior was partially bypassed by design flags - refusal was not a reliable control once --yolo-class flags existed

detected_by: third-party (community + security firms, within hours of publication)
time_to_detect: hours
time_to_recover: days-weeks (takedowns in hours; token rotation and repo remediation across victims took far longer; 90%-valid tokens show rotation lagged)
remediation: npm/GitHub takedowns; Nx advisory + token rotation; victim-side secret rotation; multi-firm IOC publication
structural_fix: Nx hardened publishing (trusted publishing/workflow fixes); ecosystem-level: the --dangerously-skip-permissions-class flags that made agents weaponizable remain available in shipped CLIs

telemetry_grade: append-only in effect (exfiltrated data landed in public GitHub repos and was independently captured and analyzed by multiple firms before takedown)
sources:
- https://www.wiz.io/blog/s1ngularity-supply-chain-attack (primary forensics)
- https://www.wiz.io/blog/s1ngularitys-aftermath (primary forensics, second wave)
- https://thehackernews.com/2025/08/malicious-nx-packages-in-s1ngularity.html
- https://www.securityweek.com/hackers-target-popular-nx-build-system-in-first-ai-weaponized-supply-chain-attack/
- https://orca.security/resources/blog/s1ngularity-supply-chain-attack/
- All five URLs verified resolving 2026-08-15.
- independence: strong - Wiz, GitGuardian, and press counts align; vendor (Nx) postmortem consistent.
aiid_incident_id: 1210 (https://incidentdatabase.ai/cite/1210/) - cross-reference; primaries verified independently
confidence: high (figures 2,349 / 1,346 / 480+ / 6,700+ verified across independent analyses; weakest link: realized downstream monetization of stolen secrets never measured)

Root cause reclassified from adversarial-other to supply-chain-compromise per v0.1 amendment 2 (Nx is one of the named motivating cases). All dates, counts, and mechanism verified as candidate stated: 2,349 secrets (The Hacker News/GitGuardian), 6,700+ private repos across 480+ accounts (Wiz aftermath analysis), AI-CLI flags confirmed verbatim.

2026-08-19: Added aiid_incident_id cross-reference (AIID 1210), matched against the AIID weekly database export (2026-08-17). A cross-reference, not a re-verification; no claim changed.

s1ngularity: Nx supply-chain attack weaponizes victims' local AI coding agents for…