Supply-chain attacks steal secrets. s1ngularity did something new: it turned your own AI tools into the thief. Between 26 and 28 August 2025, a compromised version of the popular Nx npm package became the first known supply-chain attack to actively hunt for installed AI CLIs and weaponize them.
Per Wiz and GitGuardian, the payload detected local Claude, Gemini and Amazon Q command-line tools and ran them with their most dangerous flags, --dangerously-skip-permissions, --yolo, to scan the developer’s machine for secrets. Roughly 2,349 secrets were exfiltrated across 190+ organizations and 3,000+ repositories.
TL;DR
- A compromised Nx npm package shipped a payload that looked for installed AI CLIs on the dev machine.
- It ran Claude / Gemini / Amazon Q with permission-skipping flags to do the secret-scanning work for it.
- ~2,349 secrets exfiltrated across 190+ orgs / 3,000+ repos.
- The AI CLI is a non-human identity with standing access to your files and tokens, that access is the attack surface.
What happened
Nx is a widely used monorepo build tool. When a trojanized version was installed, its post-install payload didn’t just grep for .env files itself. It checked whether the developer had an AI coding CLI installed, and if so, invoked it with flags that disable the very confirmation prompts meant to keep the tool safe, instructing it to find and collect credentials.
The CLIs did what they were built to do: read the filesystem, understand the repo, and act. They just did it for an attacker.
The genuinely new part
The distinctive step documented by Wiz was the attempt to use installed AI coding CLIs to help discover credentials. Those tools inherited access from the developer environment. The wider compromise also required investigating the malicious package’s own execution and secret-search behaviour.
The malware didn’t bring its own capability. It borrowed the capability you installed and trusted.
It’s the same lesson as the JADEPUFFER credential-harvest and the Salesloft OAuth reuse: the dangerous thing is standing, over-permissioned non-human access sitting where a foothold can reach it.
Anatomy of the path
nx-package # trojanized version on npm → postinstall # payload runs on install → ai-cli # claude / gemini / q, if present → --yolo scan # permission checks skipped, secrets collected → exfil # ~2,349 secrets, 190+ orgs
| Component | Role | Why it was abusable | Risk |
|---|---|---|---|
| npm package | Delivery | Trusted dependency, auto-run scripts | High |
| AI CLI | Weapon | Standing file access + skippable permissions | Critical |
| Local secrets | Target | Plaintext tokens on the dev machine | Critical |
The edge to cut
Contain the compromised package process as well as the AI tools it may invoke. Permission-skipping flags are one part of the attack: the payload can also search directly for credentials. Use isolated build environments, restrict filesystem and network access, and rotate exposed secrets; blocking a CLI flag alone is insufficient.
What the stolen secrets actually reached
The number that travelled was 2,349 secrets. The number that matters to a security team is a different one: how far each of those secrets could go. A developer machine is rarely a dead end. It holds the credentials that were needed to build and ship, which means it holds credentials for systems next to production.
The credentials described in the GitGuardian analysis fall into three groups, and each has a different blast radius:
| Secret on the machine | What it typically reaches | Rotation priority |
|---|---|---|
| GitHub token | Private repositories, CI configuration and the further secrets stored in them | High |
| npm publish token | The packages the developer maintains, which makes the victim the next delivery vehicle | Critical |
| Cloud and API keys in .env | Whatever the developer needed locally, often a shared staging account holding real data | Critical |
The npm row is the one that turns a single incident into a chain. A stolen publish token makes the compromised developer the origin of the next supply-chain attack, in the same way Nx became one here. That is why rotation order after an incident like this is not alphabetical: start with anything that can publish or deploy, then anything that can read source, then the rest.
The same question is worth asking before an incident. If every credential on one developer machine were copied tonight, which systems would an attacker be inside by morning? That is the real reach of the AI CLI sitting next to them, and it can be measured today rather than reconstructed afterwards.
What good looks like
- Treat AI CLIs as non-human identities. Inventory them, scope them, and know what they can read.
- Deny permission-skipping flags in CI and shared machines, where a payload can invoke them silently.
- Get long-lived secrets off developer machines. Short-lived, scoped credentials cut the target out from under the scan.
- Map the reach of every installed agent, the tool is only as dangerous as what it can traverse to.
On Elmoz
#FAQ
What was the Nx s1ngularity attack?
Between 26 and 28 August 2025 a compromised version of the Nx npm package shipped a payload that looked for installed AI coding CLIs such as Claude, Gemini and Amazon Q and ran them with permission-skipping flags to search for secrets.
How many secrets were stolen in s1ngularity?
Per Wiz and GitGuardian, roughly 2,349 secrets were exfiltrated across more than 190 organisations and more than 3,000 repositories.
How can developers reduce this risk?
Run package installs in isolated build environments, keep plaintext tokens off developer machines and treat AI CLIs as non-human identities with standing access that needs limits.
Your agents already know what they can reach. So does everyone who compromises the package sitting next to them. Elmoz shows you the same map first.