---
title: "Nx s1ngularity: Malicious npm Releases Hijack AI CLIs"
url: https://erroneo.us/security/briefs/nx-s1ngularity-malicious-npm-releases/
description: "Nx 20.9.0-21.8.0 and @nx plugins on npm stole tokens, keys and wallets, using AI CLIs to hunt secrets (CVE-2025-10894). Pulled Aug 27. Verdict: check exposure."
type: security-brief
section: "Security Digest"
date_published: 2025-08-26
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2025-10894"]
severity: "critical"
exploited: "in-the-wild"
kev: false
license: All rights reserved. Quote with attribution and a link.
---

# Nx s1ngularity: Malicious npm Releases Hijack AI CLIs

**Verdict: Check exposure.** The packages were live for about four hours in August 2025, but anything they stole (GitHub and npm tokens, SSH keys, .env files, wallets) stays useful until rotated, so confirm you were not hit rather than assume.

- **Who must act:** Anyone on Linux or macOS who installed an affected nx or @nx version, or ran Nx Console 18.6.30-18.65.1, between Aug 26 22:32 and Aug 27 02:44 UTC, 2025, and anyone who found an s1ngularity-repository in their GitHub account.
- **Who can relax:** Windows-only users, and anyone whose lockfiles and caches show no affected version and whose GitHub accounts have no s1ngularity repositories.
- **Affected:** nx 20.9.0, 20.10.0, 20.11.0, 20.12.0, 21.5.0, 21.6.0, 21.7.0, 21.8.0; @nx/devkit, @nx/js, @nx/workspace, @nx/node 20.9.0 and 21.5.0; @nx/eslint 21.5.0; @nx/key and @nx/enterprise-cloud 3.2.0; Nx Console (VS Code) 18.6.30 through 18.65.1 (could install nx@latest during the window)
- **Fixed:** Malicious versions removed from npm; nx 21.4.1 restored as latest; Nx Console 18.66.0
- **CVEs:** CVE-2025-10894
- **CISA KEV:** no · **Exploitation:** Exploited in the wild

## What to do

1. Run npm ls nx (and npm ls @nrwl/nx) in every project and remove affected versions.
2. Clear caches: npm cache clean --force, yarn cache clean --all, pnpm store prune --force, and the _npx directory; purge versions from Artifactory or Nexus.
3. Check for /tmp/inventory.txt, a 'sudo shutdown -h 0' line in ~/.bashrc or ~/.zshrc, and s1ngularity-repository repos in your GitHub account and org.
4. If any indicator is present: rotate GitHub, npm, cloud, SSH and AI CLI keys, revoke the GitHub CLI OAuth app token, and move funds from any wallet on that machine.
5. Update Nx Console to 18.66.0 or later.

### How to check if you are affected

- npm ls nx; grep -n '"nx"' package-lock.json
- ls /tmp/inventory.txt /tmp/inventory.txt.bak; grep -n 'shutdown -h 0' ~/.bashrc ~/.zshrc
- Search GitHub for repositories named s1ngularity-repository* (with results.b64) under your user and organizations, and check the security log for repos made public or renamed on Aug 28-29, 2025.
- Search shell history for claude --dangerously-skip-permissions, gemini --yolo or q --trust-all-tools runs you did not start.

## What happened

Starting at about 22:32 UTC on August 26, 2025, an attacker published malicious versions of the `nx` monorepo build system and several `@nx/*` plugins to npm. According to [StepSecurity](https://www.stepsecurity.io/blog/supply-chain-security-alert-popular-nx-build-system-package-compromised-with-data-stealing-malware), nx is downloaded about 4 million times a week. The [Nx advisory](https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c) explains the cause. A GitHub Actions workflow added on August 21 used `pull_request_target` and placed `${{ github.event.pull_request.title }}` directly in a bash step, so a pull request title could run commands. The workflow was reverted on master, but older branches still contained it. On August 24 the attacker used it to trigger `publish.yml` and send the npm publish token to a webhook. npm removed the versions and revoked tokens at about 02:44 UTC on August 27.

The payload, a `postinstall` script called `telemetry.js`, exits on Windows. On Linux and macOS it collects environment variables, `gh auth token` output, `~/.npmrc`, SSH keys, `.env` files and wallet data from MetaMask, Ledger, Trezor, Exodus, Phantom and others. The new part is that it runs any locally installed AI coding CLI with its safety prompts turned off: `claude --dangerously-skip-permissions`, `gemini --yolo` and `q chat --trust-all-tools`. It asks the CLI to search the disk for secrets and write their paths to `/tmp/inventory.txt`. [Wiz](https://www.wiz.io/blog/s1ngularity-supply-chain-attack) notes that provider safeguards sometimes refused. The results were base64-encoded two or three times into `results.b64` and pushed to a new public `s1ngularity-repository` on the victim's own GitHub account. The script also appended `sudo shutdown -h 0` to `~/.bashrc` and `~/.zshrc`.

## Who is affected

Affected releases are nx 20.9.0-20.12.0 and 21.5.0-21.8.0, the @nx devkit/js/workspace/node plugins at 20.9.0 and 21.5.0, @nx/eslint 21.5.0, and @nx/key and @nx/enterprise-cloud 3.2.0. There is a less obvious route too. Nx Console for VS Code, versions 18.6.30 to 18.65.1, ran an install of `nx@latest` to check versions, so simply opening an editor during the window could run the payload. The [CVE-2025-10894 record](https://cveawg.mitre.org/api/cve/CVE-2025-10894), issued by Red Hat, scores it 9.6 under CVSS 3.1. The Nx advisory itself says "No known CVE." The CVE is not in CISA KEV.

## Do you really need to act?

Run the checks. Do not assume you were missed. The window was only about four hours, but there was a second phase. Wiz reports that between August 28 and 29 the attacker used leaked GitHub tokens to make private repositories public. That hit more than 5,500 repositories across more than 400 users and organizations. Wiz also counted over a thousand valid GitHub tokens in the first wave. Stolen keys stay valid until rotated, and a wallet cannot be rotated at all. If your lockfiles, caches and GitHub accounts are clean, you are done. If any indicator is present, treat the machine's secrets as public.

## What to do now

1. Run `npm ls nx` in every project and in CI images. Then run `npm uninstall nx && npm install nx@latest` where needed.
2. Clear caches: `npm cache clean --force`, `yarn cache clean --all`, `pnpm store prune --force`, the `_npx` directory, and internal registry proxies.
3. Remove any unfamiliar lines from `~/.bashrc` and `~/.zshrc`, and delete `/tmp/inventory.txt`.
4. If compromised, rotate GitHub, npm, cloud, SSH and AI CLI API keys. Revoke the GitHub CLI OAuth token and sign in again. Move wallet funds to new wallets.
5. Update Nx Console to 18.66.0. Maintainers should keep PR titles out of `run:` steps and use npm Trusted Publishing, as Nx now does.

## How to tell if you were hit

Look for `/tmp/inventory.txt` or `.bak` files, the shutdown line in your shell rc files, and any `s1ngularity-repository` repo (some have `-0` or `-1` suffixes) containing `results.b64`. Check your GitHub security log for repositories made public or renamed. Search shell history for AI CLI runs with permission-bypass flags that you did not start yourself.

## Timeline

- Aug 21, 2025 — A vulnerable `pull_request_target` workflow is merged.
- Aug 24, 2025 — Attacker PR triggers publish and the npm token is sent to a webhook.
- Aug 26, 2025 — First malicious releases at about 22:32 UTC, followed by more over two hours.
- Aug 27, 2025 — npm removes the versions at about 02:44 UTC. The Nx advisory is posted.
- Aug 28-29, 2025 — Leaked tokens are used to make private repositories public.
- Sep 24, 2025 — CVE-2025-10894 is published by Red Hat.

## Sources

1. [Nx — GHSA-cxm3-wv7p-598c: Malicious versions of Nx and some supporting plugins were published](https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c)
2. [CVE Program — CVE-2025-10894 record (Red Hat CNA)](https://cveawg.mitre.org/api/cve/CVE-2025-10894)
3. [Wiz — s1ngularity: supply chain attack leaks secrets on GitHub](https://www.wiz.io/blog/s1ngularity-supply-chain-attack)
4. [StepSecurity — Popular Nx build system package compromised with data-stealing malware](https://www.stepsecurity.io/blog/supply-chain-security-alert-popular-nx-build-system-package-compromised-with-data-stealing-malware)

---
Source page: https://erroneo.us/security/briefs/nx-s1ngularity-malicious-npm-releases/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt