2025 Nx "s1ngularity" — malicious npm releases used Claude, Gemini and Q CLIs to hunt developer secrets (Aug 26)

Verified supply-chain compromise, tracked as CVE-2025-10894 — on August 26, 2025 several malicious versions of the Nx build system (20.9.0 through 21.8.0) were published to npm with a postinstall script that harvested developer credentials. The novel element was AI abuse: rather than only grepping the filesystem, the malware called locally installed AI command-line assistants including Claude, Gemini and Amazon Q, using the developer’s own authenticated agents to enumerate sensitive files and secrets on the host. Stolen data was double and triple base64-encoded and pushed to attacker-created public repositories inside victims’ own GitHub accounts named s1ngularity-repository; GitHub disabled them roughly eight hours later, but the window was long enough for the data to be downloaded. GitGuardian counted 2,349 distinct secrets from 1,079 developer systems, with GitHub, npm, AWS and OpenAI credentials most common and about half still valid at the time of analysis. In a second wave on August 28-29 the attacker reused stolen GitHub tokens to make private repositories public — over 400 users and organisations and more than 5,500 repositories by Wiz’s count, 10,767 repositories and 82,901 additional secrets by GitGuardian’s — turning one npm compromise into a mass credential exposure. Nx maintainers rotated tokens, removed the malicious versions and hardened the vulnerable workflow. recordsAffected is set to the 1,079 attested compromised developer systems; the true blast radius runs through the downstream organisations those credentials unlocked.