{
 "license": "CC-BY-4.0",
 "attribution": "Fide AI, Agentic Cyber Explorer",
 "url": "https://agentic-cyber-explorer.pages.dev/events/nx-s1ngularity-weaponized-ai-clis-2025/",
 "asOf": "2026-09-26",
 "id": "nx-s1ngularity-weaponized-ai-clis-2025",
 "date": "2025-08-26",
 "datePrecision": "day",
 "title": "s1ngularity: compromised Nx npm packages used local AI coding CLIs to hunt for secrets",
 "lane": "attack",
 "kind": "incident",
 "summary": "Attackers exploited a GitHub Actions workflow injection to steal Nx's npm token and publish malicious versions whose install script scanned systems for secrets, attempted to use locally installed AI CLIs such as Claude and Gemini to assist, and uploaded results to public GitHub repositories. Nx reports the packages were live about four hours and has since moved to trusted publishing and mandatory 2FA approval.",
 "whyItMatters": "It is an early documented case of malware invoking a victim's own AI coding agents as reconnaissance tools.",
 "actors": [
  "nx"
 ],
 "topics": [
  "agent-supply-chain",
  "ai-malware",
  "data-exfiltration"
 ],
 "atlas": [
  "supply-chain",
  "tools",
  "credentials"
 ],
 "artifacts": [
  "gemini"
 ],
 "sources": [
  {
   "url": "https://nx.dev/blog/s1ngularity-postmortem",
   "publisher": "Nx",
   "title": "S1ngularity - What Happened, How We Responded, What We Learned",
   "date": "2025-09-05",
   "type": "primary",
   "accessed": "2026-09-25"
  }
 ],
 "keyFacts": [
  {
   "fact": "Eight versions of the nx package and eleven versions of seven related @nx packages (19 versions across 8 packages) were compromised; the malicious versions were live for about four hours.",
   "locator": "Affected versions; Immediate Containment"
  },
  {
   "fact": "The post-install script attempted to use locally installed AI tools such as Claude and Gemini.",
   "locator": "Malware behavior"
  }
 ],
 "significance": 4,
 "fideQuestions": [],
 "methods": [
  "malicious-agent-extensions",
  "provenance-controls"
 ],
 "review": "assistant-drafted",
 "addedOn": "2026-09-25"
}