Notifications
Clear all
Topic starter
02/08/2026 12:28 pm
TL;DR: A compromised nx postinstall chain created s1ngularity-repository GitHub repos, stole wallets and API keys from .npmrc and environment variables, and used the harvested credentials in follow-on attacks, according to Semgrep. The incident shows that detection without rapid revocation leaves NHI exposure windows open long enough for attackers to weaponise them.
NHIMG editorial — based on content published by Semgrep covering the nx supply chain compromise: LLMjacking, secret theft, and follow-on GitHub abuse
By the numbers:
- 17 minutes, redentials are exposed publicly, attackers attempt access within an average of 17 minutes , and as quickly as 9 minutes in some cases.
- 64% of valid secrets leaked in 2022 are still valid and exploitable today, proving that detection alone is not enough without automated revocation.
Questions worth separating out
Q: What breaks when a supply chain compromise can read local developer secrets?
A: The trust model breaks because local secrets become attacker-controlled identity material before defenders can respond.
Q: Why do exposed NHI and developer tokens create such a fast follow-on risk?
A: Because attackers can usually replay them long before normal review or ticket-based remediation happens.
Q: What do security teams get wrong about secret rotation?
A: They often treat rotation as a substitute for removing the underlying credential model.
Practitioner guidance
- Rotate exposed credentials immediately Revoke GitHub tokens, npm tokens, API keys, and any cloud secrets that may have been present on affected workstations or in the compromised repositories.
- Search for install-time compromise indicators Review npm logs, lockfiles, editor extension histories, and shell profiles for evidence of the malicious postinstall path, including telemetry.js execution and unexpected entries in .zshrc or .bashrc.
- Inventory developer tooling with execution reach Catalogue IDE extensions, package managers, AI assistants, and auto-update mechanisms that can execute code or pull dependencies without explicit approval.
What's in the full analysis
Semgrep's full analysis covers the operational detail this post intentionally leaves for the source:
- Step-by-step compromise indicators for the affected nx package versions and extension paths
- Specific command lines and local file checks for validating exposure across developer workstations
- Semgrep rule content for detecting vulnerable nx usage in repositories and scans
- Updated remediation workflow for token rotation and environment review after compromise
👉 Read Semgrep's analysis of the nx supply chain compromise and secret theft →
Nx package compromise: what it means for NHI and developer identity?
Explore further
02/08/2026 1:27 pm
The real failure is secret reuse across developer tooling, not just package compromise. Once a postinstall hook can access local credentials, the attacker is no longer attacking code integrity alone. They are attacking the identity layer that links developer workstations, GitHub tokens, npm tokens, and cloud access into a single trust chain. The practitioner conclusion is simple: the secret lifecycle must be shorter than the compromise detection window.
A few things that frame the scale:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases, according to LLMjacking: How Attackers Hijack AI Using Compromised NHIs.
- 64% of valid secrets leaked in 2022 are still valid and exploitable today, proving that detection alone is not enough without automated revocation.
A question worth separating out:
Q: How should organisations govern IDE extensions in developer environments?
A: Use allowlists, central logging, and behavioural controls together. Extensions that request workspace, file system, or network access should be reviewed as access-bearing software, and any connection to unknown endpoints or unexpected process launches should trigger investigation before the extension reaches broader use.
👉 Read our full editorial: Nx supply chain compromise shows how NHI exposure scales fast
