AI-powered malware in Nx npm packages steals developer credentials
Threat actors released malicious versions of the Nx build system package on npm starting August 26, 2025, containing malware that weaponized AI CLI tools to steal developer credentials and cryptocurrency wallet data. The attack exploited popular tools including Claude, Gemini, and Amazon Q to scan infected systems and exfiltrate secrets via repositories created on victims' own GitHub accounts.
What happened
Threat actors published malicious versions of the Nx build system package to the npm registry starting on August 26, 2025. Version 21.5.0 and seven additional versions released over the next hours and day contained post-installation scripts designed to harvest sensitive developer assets.
The malware exploited local AI command-line interface tools, including Claude, Gemini, and Amazon Q, by injecting crafted prompts to force these agents to scan infected systems for sensitive files such as GitHub and npm tokens, SSH keys, environment variables, and cryptocurrency wallet data. Once collected, the stolen information was encoded and saved into files that were uploaded to new public repositories automatically created on victims' GitHub accounts using the naming pattern 's1ngularity-repository-'.
Reported impact
Wiz researchers documented over 1,000 valid GitHub tokens, dozens of valid cloud credentials and npm tokens extracted from infected enterprise systems. The malware targeted cryptocurrency wallets, GitHub and npm tokens, SSH keys, and environment variables from enterprise development environments.
The attack remained active for approximately five hours and twenty minutes before users identified it and the malicious packages were removed. JFrog separately uncovered eight additional malicious packages on npm including react-sxt, react-typex, and react-native-control, which targeted Chrome users on Windows with capabilities to extract sensitive browser data including passwords, credit card information, cookies, and cryptocurrency wallets.
Index analysis
The attack weaponized AI tools to enhance data theft operations by prompting them with dangerous flags to steal filesystem contents and exploit trusted tools for malicious reconnaissance. According to Wiz researchers, AI-powered activity succeeded in hundreds of cases, although AI provider guardrails intervened at times.
By leveraging victims' own GitHub infrastructure to store exfiltrated data rather than external command-and-control servers, the attack minimized direct traceability while relying on the victim's accounts to transmit the stolen data.
Governance controls
The malware inserted shutdown commands into shell configuration files (~/.bashrc and ~/.zshrc) to reboot the developer's machine with each new terminal session, likely intended to enhance persistence or disrupt forensic analysis.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.