1,000+ Devs Lose Their Secrets to an AI-Powered Stealer

More than 1,000 developers were infected with malware this week, with around 20,000 sensitive files leaked to the public Web, in a rapid AI-assisted supply chain compromise centred on the Nx build system. The attack on npm occurred overnight on 26 August, beginning at 22:32 UTC when attackers published new versions of the package and seven plugins before a further wave at 00:37 UTC on 27 August.

Telemetry.js, a script included in the malicious packages, was designed to steal GitHub tokens, npm tokens, SSH keys, and other secrets, using AI-enabled capabilities to identify high-value files. Investigators note that the malware relied on AI CLI tools to scan victims’ environments and that public GitHub repositories were used to exfiltrate data, exposing credentials and sensitive information.

Around 20,000 files were leaked in total, with Wiz reporting more than a thousand valid GitHub tokens and dozens of valid npm tokens and cloud credentials, according to Wiz. This incident underscores the evolving risk of AI-powered toolchains in software supply chains.