PIR-2026-0035 - s1ngularity: Nx supply-chain attack weaponizes victims' local AI coding agents for credential theft

• id: PIR-2026-0035
• title: Trojanized Nx npm packages run victims' own AI CLIs (Claude Code, Gemini CLI, Amazon Q) with safety flags disabled to hunt secrets; 2,349 secrets leaked, 6,700+ private repos later exposed
• date_occurred: 2025-08-26 to 2025-08-27 (malicious versions live on npm); second wave ~2025-08-28+ (stolen tokens used to publish victims' private repos)
• date_detected: 2025-08-26/27 (community + security-firm detection within hours; npm takedown)
• date_disclosed: 2025-08-27 onward (Nx advisory; Wiz, Semgrep, GitGuardian, broad press within days)
• status: corroborated (multi-firm forensics on public exfil artifacts + vendor postmortem)

The agent

• agent_description: Victims' locally installed AI coding CLIs - Claude Code, Gemini CLI, Amazon Q - invoked by malware as reconnaissance tools. The agents were not compromised; they were handed to the attacker by a postinstall script in trojanized versions of Nx, a very widely used build system.
• operator_type: enterprise + individual (thousands of developer machines and CI environments)
• autonomy_level: fully-autonomous during the attack window (invoked with --dangerously-skip-permissions, --yolo, --trust-all-tools)
• model_stack: Claude, Gemini, Amazon Q via victims' own authenticated CLIs
• harness: attacker-controlled prompt driving stock CLIs from a malicious npm postinstall (telemetry.js; Linux/macOS)

Authority

• authority_scope: code execution and file access as the developer user; credentials (GitHub/npm tokens, SSH keys, cloud + AI API keys, .env files); funds (crypto wallets on dev machines)
• funds_at_risk_usd: unknown (wallets targeted; no aggregate figure)
• blast_radius: customers/third parties (Nx's install base; second-order: 480+ GitHub accounts, two-thirds organizations, had 6,700+ private repos published)

The failure

• root_cause: supply-chain-compromise - primary (v0.1 taxonomy); contributing: credential-exposure (stolen npm publishing token via a vulnerable GitHub Actions workflow) and adversarial-other (weaponizing local agents)
• failure_locus: dependency (npm package); the agent layer was the attacker's tool, not the failing component
• exploitation_status: in-wild-exploited
• mechanism: Attackers exploited a vulnerable GitHub Actions workflow in the Nx repo to steal npm publishing tokens and pushed 8 trojanized Nx versions on 2025-08-26. The postinstall malware ran victims' own AI CLIs with safety flags disabled, prompting them to recursively hunt for crypto wallets, SSH keys, npm/GitHub tokens, and env files - the first documented supply-chain attack weaponizing local LLM agents for recon. Results were exfiltrated to attacker-created public GitHub repos ("s1ngularity-repository..."; 1,346 detected by GitGuardian), leaking 2,349 distinct secrets, mostly GitHub tokens (90% of 1,000+ still valid at analysis). In a second wave, stolen tokens were used to flip 6,700+ private repos public across 480+ accounts before GitHub disabled them.
• adversary_present: yes

Impact

• severity: loss (realized: mass credential compromise + confidential source-code exposure; conservative because no dollar figure exists)
• direct_loss_usd: unknown (no attributed monetary theft published)
• indirect_loss_usd: unknown (fleet-wide secret rotation and IR across hundreds of orgs)
• downtime: n/a
• data_exposure: 2,349 distinct secrets (GitHub OAuth/PATs, cloud + AI API keys, npm tokens); contents of 6,700+ private repositories
• controls_that_worked: npm removed malicious versions within hours; GitHub disabled attacker exfil repos and the force-publicized repos; notably, the agents' own safety behavior was partially bypassed by design flags - refusal was not a reliable control once --yolo-class flags existed

Detection and recovery

• detected_by: third-party (community + security firms, within hours of publication)
• time_to_detect: hours
• time_to_recover: days-weeks (takedowns in hours; token rotation and repo remediation across victims took far longer; 90%-valid tokens show rotation lagged)
• remediation: npm/GitHub takedowns; Nx advisory + token rotation; victim-side secret rotation; multi-firm IOC publication
• structural_fix: Nx hardened publishing (trusted publishing/workflow fixes); ecosystem-level: the --dangerously-skip-permissions-class flags that made agents weaponizable remain available in shipped CLIs

Evidence

• telemetry_grade: append-only in effect (exfiltrated data landed in public GitHub repos and was independently captured and analyzed by multiple firms before takedown)
• sources:
• https://www.wiz.io/blog/s1ngularity-supply-chain-attack (primary forensics)
• https://www.wiz.io/blog/s1ngularitys-aftermath (primary forensics, second wave)
• https://thehackernews.com/2025/08/malicious-nx-packages-in-s1ngularity.html
• https://www.securityweek.com/hackers-target-popular-nx-build-system-in-first-ai-weaponized-supply-chain-attack/
• https://orca.security/resources/blog/s1ngularity-supply-chain-attack/
• All five URLs verified resolving 2026-08-15. Independence: strong - Wiz, GitGuardian, and press counts align; vendor (Nx) postmortem consistent.
• confidence: high (figures 2,349 / 1,346 / 480+ / 6,700+ verified across independent analyses; weakest link: realized downstream monetization of stolen secrets never measured)

Verification notes (corrections applied)

1. Root cause reclassified from adversarial-other to supply-chain-compromise per v0.1 amendment 2 (Nx is one of the named motivating cases). All dates, counts, and mechanism verified as candidate stated: 2,349 secrets (The Hacker News/GitGuardian), 6,700+ private repos across 480+ accounts (Wiz aftermath analysis), AI-CLI flags confirmed verbatim.