s1ngularity Attack (Nx, August 2025)
The August 26–27, 2025 supply-chain attack on the popular `nx` npm build system that installed a postinstall script explicitly designed to invoke the victim's local AI CLIs (Claude Code, Gemini CLI, Q CLI) with jailbroken prompts telling them to scan `~/.ssh`, `.env` files, cryptocurrency wallets, and GitHub tokens, then exfiltrate the results. Reports put losses at ~2,180 GitHub credentials and 20,000+ files in the first 48 hours. Named 's1ngularity' after the branding used by the attackers. Significance: the first mass-scale confirmed incident where an attacker weaponized *the victim's own AI agent* as the exfiltration engine, escalating the AI-agent supply-chain threat model from theoretical to operational. Anthropic, Google, and Amazon Q teams shipped mitigations shortly after; the Nx package was cleaned up within hours but the compromised versions had already been installed at scale.
Written by Max Zeshut
Founder at Agentmelt · Last updated Sep 9, 2026
Frequently asked questions
- What are the durable lessons from s1ngularity?
- Three. First, `postinstall` scripts on packages you don't fully trust are a live attack surface — sandbox them or block them at the CI/dev-env level. Second, AI CLIs that accept prompt payloads from local processes without human confirmation are a new supply-chain vector; least-privilege CLI defaults and mandatory approval for destructive tool calls are the fix. Third, ~2,180 stolen credentials in 48 hours is the current lower bound on impact; assume the next well-executed variant will be larger.