Check exposure:s1ngularity. Anyone on Linux or macOS who installed an affected nx or @nx version, or ran Nx Console 18.6.30-18.65.1, between Aug 26 22:32 and Aug 27 02:44 UTC, 2025, and anyone who found an s1ngularity-repository in their GitHub account.
Check exposure:Salesloft Drift breach. Organizations that connected Salesloft Drift to Salesforce, Google Workspace or other systems before September 2025, and anyone who pasted credentials into Salesforce support cases or records.
Do you run any of these? Citrix NetScaler. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2025-08-28.
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
The packages were live for about four hours in August 2025, but anything they stole (GitHub and npm tokens, SSH keys, .env files, wallets) stays useful until rotated, so confirm you were not hit rather than assume.
Must act: Anyone on Linux or macOS who installed an affected nx or @nx version, or ran Nx Console 18.6.30-18.65.1, between Aug 26 22:32 and Aug 27 02:44 UTC, 2025, and anyone who found an s1ngularity-repository in their GitHub account.
Can relax: Windows-only users, and anyone whose lockfiles and caches show no affected version and whose GitHub accounts have no s1ngularity repositories.
Run npm ls nx (and npm ls @nrwl/nx) in every project and remove affected versions.
Clear caches: npm cache clean --force, yarn cache clean --all, pnpm store prune --force, and the _npx directory; purge versions from Artifactory or Nexus.
Check for /tmp/inventory.txt, a 'sudo shutdown -h 0' line in ~/.bashrc or ~/.zshrc, and s1ngularity-repository repos in your GitHub account and org.
Contained since September 2025, but if your org ever connected Drift, verify that every token and every secret sitting in your CRM or support cases was rotated, because the theft was aimed at exactly those secrets.
Must act: Organizations that connected Salesloft Drift to Salesforce, Google Workspace or other systems before September 2025, and anyone who pasted credentials into Salesforce support cases or records.
Can relax: Organizations that never used Drift; customers of affected vendors only need to watch for targeted phishing and rotate any secrets they shared in vendor support tickets.
Confirm whether Drift was ever connected to your Salesforce, Google Workspace or other tenants, and remove integrations you no longer use.
Rotate every credential, API key and OAuth token that was connected to Drift, and any secret found in Salesforce data.
Search Salesforce objects (Cases, Accounts, Contacts, Opportunities) for secrets such as AKIA keys, Snowflake tokens and passwords using TruffleHog or GitLeaks.