The s1ngularity Nx Attack Turned Your Own AI Assistants Into Accomplices in Credential Theft

catastrophic verified Claude Code gemini-cli amazon-q Last verified Jul 17, 2026

TL;DR On August 26, 2025, malicious versions of the Nx build tool hit npm and did something new: they hunted for installed AI CLI tools like Claude Code, Gemini CLI, and Amazon Q and abused them to help find and extract secrets. Roughly 2,349 distinct credentials ended up in more than 1,400 public GitHub repos, with a second wave affecting over 190 users and organizations and more than 3,000 repositories.

Date: Aug 26, 2025
Tools involved: Claude Code, gemini-cli, amazon-q
Impact: ~2,349 distinct secrets leaked to 1,400+ public GitHub repos; a second wave hit 190+ users/orgs and 3,000+ repositories.
Root cause: Malicious Nx versions published to npm ran malware that stole credentials and abused installed AI CLI tools to enumerate and extract additional secrets.

What happened

On August 26, 2025, attackers published malicious versions of Nx, a widely used JavaScript and TypeScript build system with millions of weekly downloads, to the npm registry. The malware, dubbed s1ngularity, stole GitHub tokens, SSH keys, npm credentials, and crypto wallets from the machines that installed it.

Its novel feature is what made it a milestone: the malware actively searched compromised machines for installed LLM command-line tools such as Claude Code, Gemini CLI, and Amazon Q, and abused them to help enumerate and extract additional secrets. Researchers called it the first known supply-chain attack to weaponize AI CLI tools this way. The assistants were not the vulnerability; they were the force multiplier already sitting on the box with broad access.

Stolen credentials were double-base64 encoded and exfiltrated to more than 1,400 public GitHub repositories following an 's1ngularity-repository' naming pattern. Analysis by GitGuardian and Wiz found roughly 2,349 distinct leaked secrets, dominated by GitHub OAuth tokens and personal access tokens, plus API keys for Google AI, OpenAI, AWS, Anthropic, and others.

Wiz identified a second wave affecting over 190 users and organizations and more than 3,000 repositories. The attack is repeatedly cited as a turning point in AI-era supply-chain threats because it turned developers' own AI assistants into accomplices in credential theft.

Impact

GitGuardian and Wiz counted roughly 2,349 distinct leaked secrets, dominated by GitHub OAuth tokens and personal access tokens, plus API keys for Google AI, OpenAI, AWS, Anthropic, and others. The credentials were double-base64 encoded and pushed to more than 1,400 public GitHub repositories on an 's1ngularity-repository' naming pattern, meaning the leak itself was public. A second wave identified by Wiz affected over 190 users and organizations and more than 3,000 repositories.

Root cause

The entry point was classic supply chain: malicious versions of a build tool with millions of weekly downloads, published to npm. What was new was the payload's use of the victim's own tooling. Instead of relying only on its own secret-scanning code, the malware looked for installed AI CLIs (Claude Code, Gemini CLI, Amazon Q) and abused them to help enumerate and extract more secrets. Any machine running one of those assistants had, in effect, a well-connected local operator the malware could recruit.

How to not be this entry

If a compromised package touched your machine, rotate everything: GitHub tokens, SSH keys, npm credentials, and wallet keys. Assume all of it left the building.
Treat installed AI CLIs as attack surface. s1ngularity used them to find more secrets, so limit which credentials and directories those tools can reach.
Keep long-lived secrets off developer disks and out of repositories wherever possible; short-lived scoped credentials leak with a much smaller blast radius. Read the fix guide: Accidentally committed an API key to GitHub
Vet dependencies before installing. Poisoned packages and hallucinated package names are both active attack channels aimed at developers. Read the fix guide: Slopsquatting: the AI hallucinated an npm package and an attacker registered it

Tools that actually fix this

Recommended because they address the failure mode above, not because of the payout. Some are affiliate links; see how we choose.

SocketFree for open source

The best defense against slopsquatting: it flags typosquats, brand-new or suspicious packages, and install-script malware in your pull requests, which is exactly the risk when an AI invents a package name an attacker already registered.

Try Socket →

Snykfree tier

Snyk Code catches injection and XSS right in your editor, and Snyk Open Source flags vulnerable and malicious packages. It covers several AI-code failure modes at once and is free for open source.

Try Snyk →

Frequently asked questions

What was the s1ngularity Nx supply chain attack?

On August 26, 2025, attackers published malicious versions of Nx, a popular JavaScript and TypeScript build system, to the npm registry. The malware, dubbed s1ngularity, stole GitHub tokens, SSH keys, npm credentials, and crypto wallets from machines that installed the poisoned packages, then exfiltrated the stolen secrets to public GitHub repositories.

How did s1ngularity abuse Claude Code, Gemini CLI, and Amazon Q?

The s1ngularity malware actively searched compromised machines for installed AI command-line tools such as Claude Code, Gemini CLI, and Amazon Q, then abused them to help enumerate and extract additional secrets. Researchers called it the first known supply-chain attack to weaponize AI CLI tools this way, effectively turning developers' own assistants into accomplices in credential theft.

How many secrets were leaked in the Nx s1ngularity attack?

GitGuardian and Wiz analysis found roughly 2,349 distinct leaked secrets, dominated by GitHub OAuth tokens and personal access tokens, plus API keys for Google AI, OpenAI, AWS, Anthropic, and others. The credentials were exfiltrated to more than 1,400 public GitHub repositories, and a second wave identified by Wiz affected over 190 users and organizations and more than 3,000 repositories.

What should you do if you installed a malicious Nx version?

Assume every credential on the machine is burned. The s1ngularity malware targeted GitHub tokens, SSH keys, npm credentials, and crypto wallets, so rotate all of them. Because the malware also used installed AI CLI tools to hunt for additional secrets, rotate anything those tools could reach as well.

Sources

The Vibe Oops briefing

One email when something ships to production that should not have. New incidents, new error guides, no filler.