Popular Nx Packages Compromised by Credential-Stealing Malware

A widespread supply chain attack against the popular Nx build system has compromised dozens of high-traffic packages, exposing sensitive credentials, according to GitGuardian. Security researchers confirmed that malicious versions of Nx—numbered 20.9.0 through 21.8.0—systematically scanned infected machines for secrets before exfiltrating them to public GitHub repositories in an elaborately encoded format.

Upon installation, tainted Nx packages harvested GitHub tokens, npm authentication keys, SSH private keys, environment-variable API keys, and cryptocurrency wallet files, with data pushed to uniquely named “s1ngularity-repository” GitHub repos containing a single results.b64 file. At the height of the wave, nearly 1,400 repositories were publicly accessible via GitHub, and one attacker even encoded a Rick Astley link among the exfiltrated data.

The incident also noted destructive payloads that could modify shell startup files and a focus on exploiting AI tooling credentials, highlighting the breadth of the compromise. Published by GBHackers on 29 August 2025, the piece underscores the urgency of rotating secrets and using monitoring tools like the free S1ngularity Scanner.