Nx “s1ngularity”: The Supply-Chain Attack That Weaponized Developers' AI Assistants
Key takeaways
- →Malicious versions of the popular Nx build package ran a post-install script that called installed AI CLIs (such as Claude Code and Gemini CLI) with permissive flags to find secrets and wallets.
- →The stolen data was published to public GitHub repositories created in the victims' accounts.
- →AgentGuard treats local AI CLIs as AI Principals and would have blocked an unattended, permission-bypassed invocation hunting credentials.
- 1
Malicious npm package published
- 2
Post-install script runs
- 3
Script launches local AI CLI with unsafe flags
AgentGuard blocks an unauthorized Principal invoking an AI agent outside any developer task
- 4
AI agent inventories secrets on disk
- 5
Secrets pushed to public repos
- Affected
- Developers who installed compromised Nx versions
- When
- August 2025
- Impact
- Thousands of secrets and tokens exposed publicly
What happened
On August 26, 2025, attackers published malicious versions of Nx to npm. A post-install script checked for AI coding CLIs and, if it found them, prompted them with flags that skip permission checks to search the file system for credentials, SSH keys and crypto wallets. The results were uploaded to public repositories named after the campaign.
Why it matters
The AI assistant became an attack tool with the developer's full local authority. The code that commanded it, an install script, was an illegitimate AI Principal. No EDR rule existed for 'helpful assistant searches for secrets'.
How AgentGuard would have stopped it
AgentGuard maps who can command each agent. An AI CLI launched by a package-manager child process, with no interactive developer session and with permission checks disabled, is an untrusted Commander. Its secret-hunting task would have been blocked immediately.
- Commander verification for every agent invocation
- Policy against permission-bypass flags outside approved contexts
- Credential-access task-context checks
The lesson
Every incident in this series shares one root cause: an AI system acted with real authority, and nothing in the stack was checking whether that action made sense for its task, its Principal or its environment. That's the gap AgentGuard was built to close, with zero integration and deployment measured in days.
See AgentGuard on your own environment
Zero integration. Live in days. We'll show you what your current stack is missing.