Malicious Nx Packages in ‘s1ngularity’ Attack Leaked 2,349 GitHub, Cloud, and AI Credentials

The Liverpool-based vulnerability cluster described in The Hacker News centres on a supply chain attack against the nx build system, where malicious versions of the nx package and accompanying plugins were published to npm, enabling data collection and credential exfiltration.

The nx maintainers said the rogue packages contained a postinstall script that scanned the system for text files, collected credentials, and sent them to a GitHub repository under the user’s account, with as many as 2,349 distinct secrets leaked—predominantly GitHub OAuth keys and PATs, followed by API keys for various cloud services. The compromise occurred on August 26, 2025, and the npm package had over 3.5 million weekly downloads before the affected versions were removed.

The attackers exploited a vulnerable workflow, allowing a specially crafted PR title to trigger a pull_request_target workflow that ran with a GITHUB_TOKEN having read/write access, allegedly enabling the publishing of malicious versions and exfiltration of the token to an attacker-controlled webhook. Remediation actions included rotating npm and GitHub tokens, auditing activity, and requiring 2FA for Publish access, with guidance to check for unfamiliar entries in .zshrc and .bashrc files.