On August 26, 2025, malicious versions of several Nx packages were published to npm. Attackers exploited a GitHub Actions injection vulnerability to steal our NPM publishing token and publish malicious packages for 4 hours. [...] The malicious packages ran a post-install script that scanned user systems for sensitive data, attempted to use local AI tools (like Claude and Gemini), and uploaded the results to a public GitHub repo via the GitHub CLI.
Curated from nx.dev · 1 September 2025 →
Nx is a build system with around four million weekly downloads. The way in was an unsanitised pull request title in a GitHub Actions workflow running with pull_request_target permissions, which leaked the npm publishing token. What makes this the first of its kind is what the payload then did: rather than search for secrets itself, it looked for AI coding assistants already installed and signed in on the developer's machine and asked them to do the reconnaissance, then pushed the results to a public repository created inside the victim's own GitHub account. A second wave two days later used the stolen credentials to make private repositories public. Nx moved to npm Trusted Publishers and manual release approval, and published this account itself.
