Wiz Launches Public Preview of Cloud Incident Response Service
Summary
Wiz introduced a public-preview incident response service offering cloud incident scoping, forensics, containment and remediation. The company says its team assisted organizations affected by the Nx package supply-chain attack.
Key points
- Wiz Incident Response is available to organizations facing potential cloud incidents, free of charge during public preview.
- The service offers incident scoping, forensic investigation, containment and remediation guidance, ongoing monitoring, and incident management.
- Wiz says malicious Nx package versions published on August 26, 2025, harvested developer secrets and exposed stolen data through attacker-created GitHub repositories.
- Wiz reports that it contacted more than 50 organizations and helped customers investigate exposed credentials, hunt for their misuse, and develop containment and remediation steps.
- Wiz says participating customers contained the incident and avoided impact from a later wave in which the attacker used compromised GitHub tokens to make private repositories public.
Article Details
- Event Type
- Wiz announced the public preview of Wiz Incident Response, a cloud incident response service available to organizations experiencing potential cloud incidents.
- Impact
- The article describes the s1ngularity supply chain attack involving malicious Nx package versions published to the npm registry on August 26, 2025. The malware harvested developer assets, including cryptocurrency wallets, GitHub and npm tokens, and SSH keys, then exfiltrated stolen data to attacker-created repositories in victims’ GitHub accounts. The attacker later used compromised GitHub tokens to make private repositories public. Wiz says its response team reached more than 50 major organizations and helped customers investigate and contain incidents.
MITRE ATT&CK
T1098 · Account ManipulationThe attacker used previously compromised GitHub tokens to change private repositories to public.T1552 · Unsecured CredentialsThe malware harvested sensitive developer assets, including credentials, tokens, and SSH keys.T1567 · Exfiltration Over Web ServiceStolen data was exfiltrated to publicly accessible attacker-created repositories in victims’ GitHub accounts.
Vendors
Products
NxOn August 26, 2025, multiple malicious versions of the widely used Nx build system package were published to the npm registry as part of the s1ngularity supply chain attack. These versions contained a post-installationWiz Defendextends our product capabilities in the cloud detection and response space with powerful expertise. Our Wiz Defend and Runtime Sensor deliver complete visibility and threat detection capabilities to alert you whenWiz Incident ResponseToday, we're excited to introduce the public preview of Wiz Incident Response, our new service offering to help organizations investigate, contain, and recover from cloud security incidents quickly and confidently.Wiz Runtime SensorThey’re also experts in Wiz Defend, our real-time threat detection and response engine, and the Wiz Runtime Sensor. With full integration with the entire Wiz platform, our team can surface and prioritize what