TL;DR: A compromised Nx npm package in the s1ngularity incident stole GitHub and npm tokens, SSH keys, and environment secrets, while also weaponising local AI CLI tools for reconnaissance and exfiltration, according to StepSecurity’s analysis. The case shows that developer supply chain compromise now overlaps directly with NHI governance, secrets hygiene, and tool trust boundaries.
At a glance
What this is: StepSecurity details how the Nx package compromise turned a popular build dependency into a secrets-stealing payload that also weaponised local AI CLI tools.
Why it matters: It matters because build pipelines, developer credentials, and AI assistants can all become part of the same compromise path, forcing IAM and NHI teams to treat publishing trust and runtime trust as linked controls.
Context
The security gap here is not just malicious code in a package update. It is the combination of trusted software distribution, developer credentials, and local tooling that can be coerced into revealing secrets once the package executes.
For identity and access teams, this is a machine-identity and developer-identity problem at the same time. GitHub tokens, npm tokens, SSH keys, and environment secrets were all in scope, which means compromise paths extend across publishing workflows, workstation state, and privileged automation.
The case is atypical only in its AI CLI abuse. The broader pattern, supply chain compromise leading to credential theft and repository abuse, is already familiar and should be treated as a standing governance issue.
Key questions
Q: What breaks when package installs can execute code on developer hosts?
A: Package installation stops being a simple delivery step and becomes a privilege-bearing execution event. If the host holds SSH keys, cloud tokens, or pipeline credentials, malicious package code can steal them before normal controls react. The failure mode is trusting the registry path while ignoring the host's identity and secret exposure.
Q: Why do developer tokens and SSH keys increase supply chain risk so sharply?
A: Because they are reusable identities with immediate access value. Once exposed, they can unlock code repositories, build systems, cloud services, and third-party platforms far faster than a manual response can contain them. The more places those secrets live, the harder it becomes to know which systems need revocation first.
Q: How should teams detect abuse of AI CLI tools on endpoints?
A: Watch for permissive invocation flags, unexpected filesystem enumeration, and outbound processes launched by package install events or other untrusted code paths. The key signal is not model misuse in isolation, but delegated tool use that turns an assistant into a search helper for sensitive files. Endpoint monitoring should treat AI CLI calls as part of the control surface.
Q: What should organisations do after a publishing token may have been exposed?
A: Revoke the token, check for unauthorized package releases, review repository visibility changes, and inspect forks or cloned copies that may contain stolen artefacts. Then reissue publishing access through a narrower, better-segregated identity path. The goal is to stop reuse of the compromised identity before the attacker can turn one leak into repeated publishing abuse.
Technical breakdown
How a postinstall hook turns package install into code execution
The malicious Nx release used a postinstall script, which runs automatically after package installation, to execute telemetry.js on developer machines. That matters because package managers treat install-time scripts as trusted extension points, so a poisoned dependency can inherit the permissions of the build or developer environment without any separate exploit chain. In this case, the malware gained immediate access to local files, shell-accessible credentials, and environment variables. The technical risk is not only code execution, but the collapse of the boundary between dependency trust and runtime trust. When install hooks are allowed broadly, a package update becomes an execution event, not a passive download.
Practical implication: restrict or review install-script execution in build and developer environments, especially for packages that can reach secrets or signing material.
Why GitHub, npm, and SSH credentials were all exposed together
The payload searched for several credential classes at once, including GitHub authentication tokens, npm tokens, SSH private keys, GPG keys, and .env files. That reflects how modern development environments concentrate non-human identity material in one place even when those credentials serve different systems and lifecycles. GitHub CLI tokens and npm publishing tokens are especially risky because they can authorise repository actions and package releases from a single workstation session. Once the malware had local access, it could pivot from file discovery to outbound exfiltration without needing to break multiple separate controls. This is a classic secrets sprawl problem amplified by developer tooling.
Practical implication: inventory developer-held secrets by system, rotate high-value tokens, and separate publishing credentials from general workstation access.
How AI CLI abuse expands the attack surface beyond traditional secrets theft
The novel part of the incident is the malware's use of local AI assistant CLIs such as Claude, Gemini, and q as reconnaissance helpers. By invoking them with permissive flags, the malware turned legitimate tooling into a filesystem search and inventory mechanism, then used the results to locate sensitive files. That is a governance problem because the question is no longer just whether a package can read secrets, but whether surrounding tools can be instructed to discover and classify them on the attacker's behalf. In identity terms, the attacker is abusing delegated tool trust rather than stealing only stored credentials.
Practical implication: define policy for AI CLI usage on developer endpoints, and treat permissive tool flags as a control boundary, not a convenience setting.
Threat narrative
Attacker objective: The attacker aimed to steal developer and publishing credentials, exfiltrate sensitive files, and leverage those identities to propagate compromise across repositories and package releases.
- Entry occurred when a compromised Nx npm package was installed and its post-install hook executed telemetry.js on developer machines.
- Credential harvest followed as the malware collected GitHub tokens, npm tokens, SSH keys, GPG keys, wallet files, and environment secrets from local storage.
- Exfiltration and abuse followed when the malware used collected credentials to publish malicious packages, create public repositories, and leak sensitive content into attacker-controlled GitHub assets.
Breaches seen in the wild
- CircleCI breach 2023: Malware stole a CircleCI engineer's SSO session; attackers exfiltrated customers' CI/CD secrets and keys, forcing a platform-wide rotation.
- tj-actions/changed-files compromise 2025: A stolen bot token let attackers poison tj-actions/changed-files so pipelines printed their CI/CD secrets to public logs (CVE-2025-30066).
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Supply chain compromise has become an identity problem, not only a code-integrity problem. The Nx incident shows that a poisoned package can reach far beyond the package manager and into developer-held secrets, publishing tokens, and repository controls. Once those identities are exposed, the attacker can move from execution to persistence through trusted automation. The practitioner lesson is to treat dependency trust, publishing trust, and secret trust as one control plane.
Developer endpoints now hold too many high-value identities for casual trust assumptions to survive. GitHub CLI tokens, npm tokens, SSH keys, and environment files all sat inside the same compromise window here, which is exactly how secrets sprawl becomes operationally exploitable. That means rotation policy is not enough by itself if issuance and storage remain flat and workstation-centric. The control gap is lifecycle separation, not just better detection.
AI CLI abuse is a new pattern of delegated-tool trust exploitation. The malware did not need to break the AI models themselves to cause harm, it only needed permission to ask them to search, enumerate, and reveal file paths. That creates a named concept worth tracking: delegated tool trust abuse, where legitimate assistants are used as attack multipliers. Practitioners should now consider AI tooling part of the endpoint threat surface.
Publishing controls must assume token compromise is an expected failure mode. The incident and the second wave of repository abuse show how quickly stolen credentials can be converted into package release abuse and repository exposure. This is exactly the kind of condition that OWASP-NHI and MITRE ATT&CK describe when credential access and overprivileged non-human identities are left with broad reach. The governance conclusion is simple: if a publishing identity can be reused after compromise, the control design is already behind.
From our research library:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- Read next: Guide to the Secret Sprawl Challenge
What this signals
Delegated tool trust abuse is the right concept for this incident: a malicious package used locally installed AI assistants and developer utilities as discovery helpers, which means endpoint policy now has to govern what those tools may inspect and reveal.
Supply chain teams should expect the next wave of attacks to blend code compromise with identity theft, because once a maintainer token or workstation secret is exposed, repository abuse and package abuse become interchangeable paths.
92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs. That exposure pattern makes least-privilege publishing and secret segregation the baseline, not the finish line.
For practitioners
- Audit install-script execution paths Identify packages that can run postinstall or similar hooks in developer and CI environments, and block execution where the package does not require it for function.
- Rotate exposed developer credentials Revoke GitHub tokens, npm tokens, SSH keys, and GPG keys associated with any affected workstation or maintainer account, then reissue only through controlled channels.
- Separate publishing identities from day-to-day accounts Use distinct non-human identities for package publishing and repository administration so a workstation compromise cannot immediately reach release privileges.
- Constrain AI CLI use on developer endpoints Disable or tightly govern permissive flags such as trust-all-tools and dangerously-skip-permissions on locally installed AI assistants that can inspect the filesystem.
- Search for repository exposure indicators Look for renamed public repositories, unexpected forks, and uploaded artefacts such as results.b64 that indicate credential-driven follow-on abuse.
Key takeaways
- The Nx compromise shows how a single poisoned dependency can convert installation time into execution time and expose a broad developer secret estate.
- The incident affected a package downloaded 4 million times per week and reached GitHub tokens, npm tokens, SSH keys, environment files, and local AI tooling.
- Teams need tighter control over install hooks, stronger credential separation, and governance for AI CLI usage on developer endpoints.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | The article centres on exposed GitHub, npm, SSH, and environment secrets stolen from a poisoned dependency. |
| NHI-05 — Overprivileged NHI | Publishing and repository identities had enough privilege to turn stolen tokens into package and repo abuse. | |
| NHI-07 — Long-Lived Secrets | Long-lived tokens such as GitHub CLI and npm credentials widened the attack window after exposure. | |
| Recommendation — Scan build and developer environments for exposed NHI secrets and revoke any leaked credentials immediately. Reduce publishing and repository privileges so compromised tokens cannot reach release or visibility controls. Shorten secret lifetimes and rotate publishing credentials on a fixed cadence. | ||
| MITRE ATT&CK | TA0006;TA0010 — Credential Access; Exfiltration | The malware harvested local credentials and exfiltrated them for downstream repository and package abuse. |
| Recommendation — Map suspicious dependency execution to credential access and exfiltration techniques for investigation and detection. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The incident exposed weak entitlement separation across publishing, repository, and developer access. |
| Recommendation — Review entitlements so developer accounts cannot directly exercise publishing-grade access. | ||
Key terms
- Preinstall Hook: A preinstall hook is package code that runs before an application installs or starts. In supply-chain attacks, it becomes a hidden execution point that can steal secrets, alter environments, or drop further payloads before normal controls see the package's behaviour.
- Tool Delegation Trust: The assumption that an agent may safely call external tools or services once the model appears authorised. This is a governance failure if the delegation boundary is not explicitly scoped, monitored, and revocable.
- Secrets Sprawl: The uncontrolled proliferation of sensitive credentials, API keys, tokens, passwords, certificates, across codebases, cloud environments, CI/CD pipelines, and configuration files. In 2024, over 50 million leaked secrets were found on the dark web.
- Publishing Identity: The account, token, or credential set that authorises changes to a software package distribution channel. It is a privileged non-human identity because it can affect many downstream systems at once, so compromise of this identity can become an ecosystem-wide security event.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course, the industry's only accredited NHI security programme. It helps practitioners connect machine identity controls to broader access governance.
Published by the NHIMG editorial team on August 20, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org