Wiz Details Nx Supply-Chain Attack’s Impact and AI-Assisted Data Theft
Summary
Wiz reports that malicious Nx packages exposed secrets and private repositories through a three-phase attack. Its analysis found AI-assisted file discovery succeeded in under a quarter of cases, while many leaked credentials remained valid.
Key points
- The attacker used a compromised npm publishing token, obtained via a vulnerable GitHub Action, to distribute malicious Nx package versions.
- In Phase 1, secrets from over 1,700 users were publicly exposed; Wiz says more than 2,000 unique verified secrets were leaked.
- Phase 2 involved at least 480 compromised accounts making over 6,700 private repositories public; Phase 3 exposed over 500 repositories belonging to one organization.
- Wiz found almost 90% of leaked GitHub tokens remained valid more than 24 hours after the repositories were removed; after GitHub’s revocation effort, roughly 5% remained valid.
- Malware used installed AI command-line tools to identify files for exfiltration. Wiz says this succeeded in under a quarter of cases, yielding fewer than 100 unique valid secrets across 20,000 files.
- Wiz recommends reviewing GitHub Audit Logs for phase-specific repository events, rapid cloning activity, and credential deauthorization events attributed to “github-staff.”
- The activity had lulled, but Wiz warns exposed secrets and data in formerly private repositories could enable further attacks; it reported that over 40% of leaked npm tokens from Phase 1 remained valid.
Article Details
- Attack Vectors
- The attacker compromised an npm publishing token for Nx packages through a vulnerable GitHub Action, then published malicious package versions.
- Malware in the malicious packages collected environment variables and GitHub and npm tokens, and used the GitHub CLI to publish stolen data in public repositories on victims’ GitHub accounts.
- The attacker used leaked GitHub tokens to make victims’ private repositories public.
- The malware used locally configured AI command-line tools to identify files for possible exfiltration.
- During the initial compromise of Nx’s npm token, the attacker appears to have used webhook.site for remote exfiltration.
- Defensive Notes
- Review GitHub Audit Logs for the s1ngularity string in the repo field of repo.create events (Phase 1) and repo.access events (Phase 2).
- Investigate instances of a single user cloning a wide set of repositories in a short timeframe.
- Review GitHub Audit Logs for org_credential_authorization.deauthorize events associated with the “github-staff” actor_id.
- Assess and rotate exposed credentials, including GitHub and npm tokens; the article reports that some remained valid after the exposed repositories were removed.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | webhook[.]site | Reportedly used by the attacker for remote exfiltration during the initial compromise of Nx’s npm token. |
MITRE ATT&CK
T1005 · Data from Local SystemThe malware collected environment variables, GitHub and npm tokens, and potentially sensitive local files.T1059.004 · Unix ShellMalware invoked locally installed AI CLIs, including Claude, Gemini, and Amazon Q, to search for files to inventory.T1059.006 · PythonThe article describes a single-threaded Python script used to publish repositories; the User-Agent strings were python-requests/2.32.3 and python-requests/2.32.4.T1082 · System Information DiscoveryThe malware checked for installed AI CLIs and searched local paths and files to identify potential data for collection.T1090.003 · Multi-hop ProxyThe attacker leveraged TOR when accessing victim accounts during Phase 2.T1195.002 · Compromise Software Supply ChainThe attacker compromised an npm publishing token through a vulnerable GitHub Action and distributed malicious Nx package versions.T1528 · Steal Application Access TokenThe malware collected GitHub and npm tokens, and the attacker later used leaked GitHub tokens to expose private repositories.T1567.001 · Exfiltration to Code RepositoryThe malware exfiltrated data by publishing it in public GitHub repositories created on victims’ accounts.T1567.002 · Exfiltration to Cloud StorageThe article reports remote exfiltration through webhook.site during the initial compromise of Nx’s npm token.
Vendors
Anthropicsecrets across 20,000 exfiltrated files. The majority of these secrets were for AI services (Langsmith, Anthropic, OpenAI), and cloud platforms (AWS, Azure, Vercel). We have yet to observe any successful cryptocurrencyOpenAI20,000 exfiltrated files. The majority of these secrets were for AI services (Langsmith, Anthropic, OpenAI), and cloud platforms (AWS, Azure, Vercel). We have yet to observe any successful cryptocurrency relatedWizWiz Research has been responding to the s1ngularity incident since news first broke on August 26th. At this point, active attacks seem to have lulled. This gives us an opportunity to step back and share what we’ve
Products
Amazon QAll three variants share code for identifying the presence of popular AI CLIs (Claude, Gemini, and Amazon Q): ClaudeAll three variants share code for identifying the presence of popular AI CLIs (Claude, Gemini, and Amazon Q): GeminiAll three variants share code for identifying the presence of popular AI CLIs (Claude, Gemini, and Amazon Q): GitHubthe impact of this attack to date, dissect the role of AI, and provide guidance on reviewing relevant GitHub logs based on novel TTPs. For a detailed account of the initial incident, refer to our previous blog post.GitHub ActionsThe s1ngularity incident evokes a string of recent Github Actions related supply chain compromises, including Ultralytics and tj-actions. However, those cases felt a bit like near misses: the cryptomining payload ofnpmAn attacker compromised an npm publishing token for nx packages via a vulnerable GitHub Action. They abused that access to distribute new, malicious versions of a variety of Nx packages. The end result was thousands ofNxAn attacker compromised an npm publishing token for nx packages via a vulnerable GitHub Action. They abused that access to distribute new, malicious versions of a variety of Nx packages. The end result was thousands of