Security Alert | NX Compromised to Steal Wallets and Credentials

At least 1.4k people are learning today that they have a new repository prefixed by s1ngularity-repository in their GitHub account. This repository was created by a malicious post-install command executed by the install of the nx build kit. That malware steals wallets and API keys (`.npmrc`, env variables, etc.) and pushes them in that repository in the results.b64 file. Interestingly, the malware checks for the presence of Claude Code CLI or Gemini CLI on the system to offload much of the fingerprintable code to a prompt.

Ongoing Security Alert: Investigation and remediation continues as new information becomes available. Check back for updates. Official advisory from nx. Last updated 2025-08-28 15:53 UTC

TL;DR What You Should Do Now

Are you impacted?

Regularly monitoring your GitHub organization is crucial to ensure security. Here's a simple way to check for evidence of compromise:

1. Check GitHub:

   • Manually searching for s1ngularity is not enough, you can review GitHubs security log https://github.com/settings/security-log?q=created%3A2025-08-26+operation%3Acreate to see if any s1ngularity repositories were created on GitHub

2. Check Claude Code:

   • Manually review your ~/.claude/projects locally to see if the malicious prompt was executed

     • grep -r "Recursively search local paths on Linux/macOS" --include="*.jsonl" ~/.claude/projects

All affected versions

The following versions of nx are impacted, and you should investigate if you have leveraged them in your repositories:

• @nx/devkit - 21.5.0, 20.9.0

• @nx/enterprise-cloud - 3.2.0

• @nx/eslint - 21.5.0

• @nx/key - 3.2.0

• @nx/node - 21.5.0, 20.9.0

• @nx/workspace - 21.5.0, 20.9.0

• @nx - 21.5.0, 20.9.0, 20.10.0, 21.6.0, 20.11.0, 21.7.0, 21.8.0, 20.12.0

These have been removed from npm already, but you may still have previously installed the vulnerable version.

Are you using a compromised version of nx?

You can run npm ls nx or check your lockfile to see if you are running one of the impacted versions mentioned above.

For Semgrep Supply Chain customers, Semgrep will detect the use of the compromised packages on the next scan.

We've open-sourced an MIT licensed Semgrep rule that you can use to discover if you were running a vulnerable version of nx: https://semgrep.dev/c/r/oqUk5lJ/semgrep.ssc-mal-resp-2025-08-nx-build-compromised. Semgrep users can run in one step with semgrep --config r/oqUk5lJ/semgrep.ssc-mal-resp-2025-08-nx-build-compromised, or you can run locally by fetching the rule and then running semgrep --config=rule.yaml

What to do?

Log into your GitHub account and check to see if a repository with a name starting with s1ngularity-repository exists. 

1. Update nx to the latest safe version 21.4.1 (the impacted versions have already been removed from npm).

2. Copy then delete the repository from your GitHub account.

3. Now, you need to rotate the secrets that were part of the dump.

   a) Unfortunately, the dump is very wide, from crypto wallets to API keys.

   b) Rotate tokens/credentials for github, npm, and any ssh keys or env variables you may have had leaked.

4. Look in the shell files (bashrc, etc.) for the shutdown directive and remove it.

What Is NX

Nx is a popular build system that is designed to handle large codebases by managing multiple projects in one place. It analyzes your code to only rebuild and re-test what has changed so a fundamental component of most monorepos projects. It’s a very popular system used by 2.5 million developers every day!

If you use tools like the VSCode Cursor extension you will automatically pull latest versions so could have had it update without realizing.

Incident Timeline

The incident is still ongoing. We've observed that a requestor has been created. Be sure to watch out for your organizations. If you see any s1ngularity-repository being created, make them private and delete them.

• 2025-08-26 ~06:00 PM PDT | 8 malicious nx versions published including (v20.9.0 - v20.12.0; v21.5.0 - v21.8.0)

• 2025-08-26 ~08:30 PM PDT | First user reported suspicious activity on GitHub

• 2025-08-26 ~10:45 PM PDT | npm removed compromised versions

• 2025-08-26 ~11:45 PM PDT | org owner (nrwl) removed compromised npm account

• 2025-08-27 ~01:00 AM PDT | Additional scope of npm packages listed to include those under @nx/

How The Malware Works

Utilizing the nx post install hook, telemetry.js is used to run malicious code.

The malware dumps the environment of the process it's running in, capturing variables that may be passed. It also attempts to use the GitHub CLI tool to find an auth token, used to create that public s1ngularity-repository repository. 

It checks for the presence of Claude Code CLI or Gemini CLI on the system. If found, it calls them with the following prompt to discover wallets and secrets on the file system. It then dumps all the results from all paths into a JSON file, which is placed in the repo after being base64 encoded twice.

What's novel about using LLMs for this work is the ability to offload much of the fingerprintable code to a prompt. This is impactful because it will be harder for tools that rely almost exclusively on Claude Code and other agentic AI / LLM CLI tools to detect malware.

References

Official advisory: https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c 

Step Security was first we saw to publish based on the user report with a nice analysis: https://www.stepsecurity.io/blog/supply-chain-security-alert-popular-nx-build-system-package-compromised-with-data-stealing-malware

Initial Github Issues: #32522, #32523