s1ngularity: npm malware turned developers' AI coding tools against them
What happened
Malicious versions of the Nx build tool, which has millions of weekly downloads, ran a script that ordered any installed Claude, Gemini or Amazon Q command-line assistant to hunt for secrets on the victim's machine. Stolen tokens, SSH keys and wallets were posted to public GitHub repos, and a second wave used them to make thousands of private repositories public.
Nx is a build system for JavaScript projects with millions of weekly downloads. On 26 and 27 August 2025 an attacker used a publishing token, stolen through a flawed GitHub Actions workflow in the Nx repository, to release tainted versions to npm. On install they ran a script that searched the machine for GitHub and npm tokens, SSH keys, cloud keys, environment files and crypto wallets. If Claude Code, Gemini CLI or Amazon Q's command-line tool was installed, the script launched it with its safety prompts switched off and instructed it to hunt the file system for secrets, turning the developer's own AI assistant into part of the malware; some of the assistants refused. The loot was uploaded to a new public repository named s1ngularity-repository in the victim's own GitHub account, and the script also added a shutdown command to shell start-up files. In a second wave the stolen tokens were used to make thousands of victims' private repositories public. Researchers counted over 1,000 valid GitHub tokens and more than 2,000 leaked secrets.
How it happened
Manipulated AI: Agent hijack. Malware or poisoned configuration took control of AI tools already installed on the victim's machine and turned them against the victim.
Models from several AI vendors were involved. The product was Claude Code, Gemini CLI, Amazon Q, a type of coding assistant.
Impact
Data was exposed. Data involved: credentials and source code. The impact spread across a wide ecosystem of developers, users and organizations.
Severity is rated High, calculated from how far the incident reached and how sensitive the data was.
Was the AI at fault?
No. The failure was in the systems, settings or people around the AI, not in the model's behaviour.
Status and timeline
Confirmed by the affected organization, the AI vendor, a regulator or a named security research firm.
It became public on 26 Aug 2025.
npm removed the malicious versions, GitHub took down the exposed repositories, and Nx published a post-mortem and fixed the workflow. Victims were told to rotate every credential on affected machines.