Over 6,700 Private Repositories Made Public in Nx Supply Chain Attack

Hackers behind the Nx supply chain attack used stolen secrets to publish more than 6,700 private repositories publicly, Wiz says in its assessment. The second phase of the operation saw compromised NPM tokens used to create a wave of public repositories named with the s1ngularity-repository-#5letters# scheme, with one organisation having over 700 repositories leaked and thousands of valid credentials appearing in the repos.

Wiz notes that the attackers also exfiltrated more than 20,000 stolen files affecting 225 distinct users, and that the malware modified shell startup files to crash terminals while listing AI CLIs such as Claude and Gemini for reconnaissance and data exfiltration. In total, security researchers identified more than 2,300 secrets leaked in those repositories, with Wiz stating that more than 1,700 users had secrets leaked as part of the attack.

The firm advises affected users to rotate compromised secrets, hunt for indicators of compromise, and check GitHub Audit Logs for the org_credential_authorization.deauthorize event as GitHub mass revocation of compromised credentials continues, according to Wiz. The report was published on 8 September 2025.