Nx supply chain malware uses developers’ AI coding tools to hunt for secrets

Timeline

• 2025-08-26. Malicious versions of Nx packages are published and stay live for about four hours.
• Following days. Stolen credentials are used to make victims’ private repositories public, according to Wiz.
• 2025-09-05. Nx publishes its postmortem.

Trigger or entry point

According to Nx, an attacker injected code through the title of a pull request into a GitHub Actions workflow. This yielded a token with write access, which the attacker used to run the publishing workflow and capture the npm token.

Failure mechanism

The malicious packages ran a script at install time. Besides collecting credentials directly, the script looked for AI command-line assistants on the machine. Where it found one, it started it with the flags that turn off permission prompts and gave it a prompt to search the file system for wallets, keys and other secrets. Wiz reports that the AI step succeeded in fewer than a quarter of cases, in part because some tools refused.

Impact

Nx has about 6 million weekly installs. Wiz counted more than 1,700 users with leaked secrets and over 2,000 verified secrets in the first phase. In a second phase, at least 480 accounts had more than 6,700 private repositories published. Leaked secrets cannot be recalled, which is why this entry is rated SEV1.

Response

npm removed the packages and revoked the tokens. GitHub took the leak repositories offline. Nx published a security advisory.

Mitigations

Nx reports that it:

• moved to npm Trusted Publishers, which removes long-lived tokens,
• requires manual approval with two-factor authentication to publish,
• requires approval before pipelines run for outside contributors.

Wiz advises treating AI command-line tools as sensitive and monitoring how they are started.