What happened
It was reported that on 26 August 2025 an attacker exploited an injection flaw in one of the Nx project’s GitHub Actions workflows and took the token used to publish Nx to the npm registry. Malicious versions of the nx package went out, along with malicious versions of the devkit, js, workspace, node, eslint, key and enterprise cloud plugins. In a postmortem it published itself, Nx records that they were available for about four hours. Once installed, the code searched the machine for sensitive data and uploaded what it found to a public GitHub repository created under the victim’s own account, using the GitHub command-line tool. GitHub’s advisory records that the script also appended a shutdown command to the shell startup files, so the next terminal the developer opened would ask for their password and then shut the machine down.
It was reported that Wiz, which analysed the attack, found the script also hunting for AI command-line tools installed locally, naming the Claude, Gemini and Q tools. Where it found one it launched that tool with the flags that switch off its confirmation and permission prompts, and set it to search the file system. The prompt is reproduced in an appendix to GitHub’s advisory. It casts the tool as a file search agent, tells it to find plain text configuration and environment definition files, tells it not to open or read their contents beyond what is needed to confirm a file is plain text, and tells it to write a list of file paths and nothing else. Wiz reported that this worked in hundreds of cases, and that provider guardrails at times refused the instruction. What went out included wallets, keystores, environment files and SSH keys, alongside the GitHub authentication token and the contents of the npm configuration. Wiz counted over a thousand valid GitHub tokens, dozens of cloud credentials and npm tokens, and roughly twenty thousand files, and reported that GitHub disabled the repositories holding the stolen data at 09:00 UTC on 27 August, about eight hours after they began appearing. Between 16:00 UTC on 28 August and 02:00 UTC on 29 August the attacker used the stolen tokens again, making more than 5,500 private repositories public and renaming them, across more than 400 users and organisations. Nx has since moved publishing to npm trusted publishing with OIDC, made manual two factor approval mandatory before any publish, stopped external contributor pull requests from running its pipelines, and added provenance verification.
What an auditable version would have shown
The missing record is what happened on each affected machine: which AI tool was launched, what launched it, what it was asked to find and what it returned. That would help establish how many machines were affected, and what the AI tools found compared with what the malicious script found on its own. Wiz could establish that the AI-assisted activity worked in hundreds of cases, but the public record does not contain individual agent logs showing exactly what happened on each machine.
Where the gap was
It was reported that the malicious script launched AI tools already installed on developers’ machines using flags that bypassed their normal confirmation or permission prompts. The tools were then used to search for sensitive files. An AuthorityGate checks where an instruction came from before the agent acts on it. An EgressGate adds another check before sensitive information leaves the machine. The AI tools themselves had not been compromised. The malicious package was using legitimate tools already available on the machine as part of the attack.
What governance should have looked like
It was reported that Nx tightened its publishing controls after the attack, moving to trusted publishing, requiring manual two-factor approval and adding provenance checks. That addresses how the malicious packages were published. The incident also raises a separate problem on the developer’s machine: if an AI tool can run with its normal confirmations disabled, there needs to be another way to decide whether the process giving it instructions can be trusted. The source of the instruction is checked before the agent acts, and sensitive information is checked before it leaves the machine. Wiz reported that provider guardrails sometimes stopped the instructions. Refusals that happen only some of the time are not a permission control.
Failure Pattern: a malicious package-install script launched local AI coding tools with their confirmation prompts disabled and instructed them to search the file system, and the process provided no independent authority check separating an instruction from an untrusted package script from one made by the developer.
Governance Principle: an agent should be able to establish where an instruction came from and whether that source is authorised to direct it, and a record of what it then did should survive on the machine that ran it.
The reference implementation of AuthorityGate and EgressGate is open source. It lives at github.com/saffronandindia/headlights-oss, Apache 2.0 licensed and free to install. The repository is public now.
Sources
- S1ngularity: what happened, how we responded, what we learned (Nx, 5 September 2025)
- s1ngularity: supply chain attack leaks secrets on GitHub, everything you need to know (Wiz, 27 August 2025)
- Compromised nx npm package versions, security advisory GHSA-cxm3-wv7p-598c (GitHub)