NPM · AUGUST 2025 · CONFIRMED

Nx “s1ngularity” npm Attack: What Happened

On August 26, 2025, attackers exploited a GitHub Actions injection vulnerability in the Nx build system's repository to steal its npm publish token and push malicious versions of Nx and several supporting plugins to the registry. The malicious postinstall script scanned infected developer machines for sensitive files, attempted to use locally installed AI command-line tools to help locate valuable secrets, and uploaded everything it found to public GitHub repositories. Publicly dubbed “s1ngularity,” the attack leaked more than 2,300 distinct secrets from over 190 organizations before it was shut down roughly four hours later.

What happened

The root cause traced back to a vulnerable GitHub Actions workflow added on August 21, 2025 that validated pull request titles in a way that allowed shell command injection: an attacker crafted a pull request with a malicious title containing shell commands, and because of how the workflow was configured with pull_request_target, those commands executed with the repository's own permissions. That gave the attacker a repository-scoped GitHub token, which they used to create a branch, trigger the package publish workflow, and ultimately steal the npm token used to publish Nx itself.

The resulting malicious packages ran a postinstall script that scanned the infected system for sensitive data, notably attempting to invoke locally available AI assistants such as Claude and Gemini to help identify valuable secrets on disk, then exfiltrated the results to a public GitHub repository using the GitHub CLI. Researchers found the majority of the roughly 2,349 leaked secrets were GitHub OAuth tokens and personal access tokens, alongside API keys for Google AI, OpenAI, AWS, OpenRouter, Anthropic, PostgreSQL, and Datadog. Wiz identified over 190 affected users and organizations and more than 3,000 exposed repositories, with the large majority of the leaked GitHub tokens still valid at the time of discovery.

How 0Day mitigates this

A BUILD-TOOL COMPROMISE REACHES EVERY REPO THAT USES ITNx sits in CI pipelines rather than production code, which is exactly the kind of dependency that's easy to overlook when thinking about supply chain risk. 0Day treats build and tooling dependencies the same as any other package in your organization's dependency graph, so a compromise like this one, however it enters the registry, still triggers an alert to every repository that pulls it in, whether it's a runtime dependency or a piece of your build pipeline.

See how continuous, corroborated monitoring differs from a periodic scan, or read the exact, read-only access 0Day needs to watch your full dependency graph.

Sources

The Hacker News: Malicious Nx Packages in "s1ngularity" Attack
Nx Blog: s1ngularity Postmortem
StepSecurity: Nx Build System Compromised with Data-Stealing Malware

Join the 0Day waitlist →

← Back to all incidents