Nx Build System Compromise Targets Developers with AI-Enhanced Supply Chain Attack

The StepSecurity research team has warned of a large-scale supply chain attack targeting the Nx build system, which is downloaded more than 4 million times weekly. On 26 August 2025, attackers published compromised Nx versions containing a malicious payload designed to steal cryptocurrency wallets, SSH keys, environment variables, and developer tokens, with activity beginning around 23:00 UTC that day.

According to StepSecurity’s report, the compromised package contains a malicious post-install hook that triggers a file named telemetry.js, giving attackers access to developer machines at scale. The malware, engineered for Linux and macOS, enumerates sensitive files, harvests GitHub and npm tokens, and collects SSH keys and environment variables, and it even attempts to abuse locally installed AI assistant CLIs to bypass security boundaries.

Public GitHub repositories were created using stolen tokens, and the stolen data was triple-base64 encoded and uploaded as results.b64, while some victims’ shell configurations were modified to trigger a forced shutdown in new terminals. If you’re using Nx 20.9.0 to 21.8.0, immediate action such as purging code, updating dependencies, and revoking credentials is advised.