Nx s1ngularity: Malicious npm Releases Hijack AI CLIs

What to do

1. Run npm ls nx (and npm ls @nrwl/nx) in every project and remove affected versions.
2. Clear caches: npm cache clean --force, yarn cache clean --all, pnpm store prune --force, and the _npx directory; purge versions from Artifactory or Nexus.
3. Check for /tmp/inventory.txt, a 'sudo shutdown -h 0' line in ~/.bashrc or ~/.zshrc, and s1ngularity-repository repos in your GitHub account and org.
4. If any indicator is present: rotate GitHub, npm, cloud, SSH and AI CLI keys, revoke the GitHub CLI OAuth app token, and move funds from any wallet on that machine.
5. Update Nx Console to 18.66.0 or later.

How to check if you are affected or compromised

• npm ls nx; grep -n '"nx"' package-lock.json
• ls /tmp/inventory.txt /tmp/inventory.txt.bak; grep -n 'shutdown -h 0' ~/.bashrc ~/.zshrc
• Search GitHub for repositories named s1ngularity-repository* (with results.b64) under your user and organizations, and check the security log for repos made public or renamed on Aug 28-29, 2025.
• Search shell history for claude --dangerously-skip-permissions, gemini --yolo or q --trust-all-tools runs you did not start.

What happened#

Starting at about 22:32 UTC on August 26, 2025, an attacker published malicious versions of the nx monorepo build system and several @nx/* plugins to npm. According to StepSecurity, nx is downloaded about 4 million times a week. The Nx advisory explains the cause. A GitHub Actions workflow added on August 21 used pull_request_target and placed ${{ github.event.pull_request.title }} directly in a bash step, so a pull request title could run commands. The workflow was reverted on master, but older branches still contained it. On August 24 the attacker used it to trigger publish.yml and send the npm publish token to a webhook. npm removed the versions and revoked tokens at about 02:44 UTC on August 27.

The payload, a postinstall script called telemetry.js, exits on Windows. On Linux and macOS it collects environment variables, gh auth token output, ~/.npmrc, SSH keys, .env files and wallet data from MetaMask, Ledger, Trezor, Exodus, Phantom and others. The new part is that it runs any locally installed AI coding CLI with its safety prompts turned off: claude --dangerously-skip-permissions, gemini --yolo and q chat --trust-all-tools. It asks the CLI to search the disk for secrets and write their paths to /tmp/inventory.txt. Wiz notes that provider safeguards sometimes refused. The results were base64-encoded two or three times into results.b64 and pushed to a new public s1ngularity-repository on the victim's own GitHub account. The script also appended sudo shutdown -h 0 to ~/.bashrc and ~/.zshrc.

Who is affected#

Affected releases are nx 20.9.0-20.12.0 and 21.5.0-21.8.0, the @nx devkit/js/workspace/node plugins at 20.9.0 and 21.5.0, @nx/eslint 21.5.0, and @nx/key and @nx/enterprise-cloud 3.2.0. There is a less obvious route too. Nx Console for VS Code, versions 18.6.30 to 18.65.1, ran an install of nx@latest to check versions, so simply opening an editor during the window could run the payload. The CVE-2025-10894 record, issued by Red Hat, scores it 9.6 under CVSS 3.1. The Nx advisory itself says "No known CVE." The CVE is not in CISA KEV.

Do you really need to act?#

Run the checks. Do not assume you were missed. The window was only about four hours, but there was a second phase. Wiz reports that between August 28 and 29 the attacker used leaked GitHub tokens to make private repositories public. That hit more than 5,500 repositories across more than 400 users and organizations. Wiz also counted over a thousand valid GitHub tokens in the first wave. Stolen keys stay valid until rotated, and a wallet cannot be rotated at all. If your lockfiles, caches and GitHub accounts are clean, you are done. If any indicator is present, treat the machine's secrets as public.

What to do now#

1. Run npm ls nx in every project and in CI images. Then run npm uninstall nx && npm install nx@latest where needed.
2. Clear caches: npm cache clean --force, yarn cache clean --all, pnpm store prune --force, the _npx directory, and internal registry proxies.
3. Remove any unfamiliar lines from ~/.bashrc and ~/.zshrc, and delete /tmp/inventory.txt.
4. If compromised, rotate GitHub, npm, cloud, SSH and AI CLI API keys. Revoke the GitHub CLI OAuth token and sign in again. Move wallet funds to new wallets.
5. Update Nx Console to 18.66.0. Maintainers should keep PR titles out of run: steps and use npm Trusted Publishing, as Nx now does.

How to tell if you were hit#

Look for /tmp/inventory.txt or .bak files, the shutdown line in your shell rc files, and any s1ngularity-repository repo (some have -0 or -1 suffixes) containing results.b64. Check your GitHub security log for repositories made public or renamed. Search shell history for AI CLI runs with permission-bypass flags that you did not start yourself.

Timeline#

• Aug 21, 2025 — A vulnerable pull_request_target workflow is merged.
• Aug 24, 2025 — Attacker PR triggers publish and the npm token is sent to a webhook.
• Aug 26, 2025 — First malicious releases at about 22:32 UTC, followed by more over two hours.
• Aug 27, 2025 — npm removes the versions at about 02:44 UTC. The Nx advisory is posted.
• Aug 28-29, 2025 — Leaked tokens are used to make private repositories public.
• Sep 24, 2025 — CVE-2025-10894 is published by Red Hat.

Vulnerability records

• CVE-2025-10894 · Malicious code was inserted into the Nx (build system) package and several related plugins.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Nx — GHSA-cxm3-wv7p-598c: Malicious versions of Nx and some supporting plugins were published github.com
2. CVE Program — CVE-2025-10894 record (Red Hat CNA) cveawg.mitre.org
3. Wiz — s1ngularity: supply chain attack leaks secrets on GitHub wiz.io
4. StepSecurity — Popular Nx build system package compromised with data-stealing malware stepsecurity.io