Malicious Nx npm Packages Steal Developer Secrets and Expose Private GitHub Repositories
Summary
Malicious Nx package versions published August 26, 2025, harvested developer secrets and exposed data in public GitHub repositories. Stolen tokens were later used to publish more than 5,500 private repositories; Wiz recommends removing affected versions and rotating at‑
Key points
- Malicious Nx packages used a post-install script to search Linux and macOS systems for wallets, SSH keys, environment files and developer tokens; some infections reportedly occurred through the Nx VSCode extension or GitHub Actions.
- The malware encoded stolen data and uploaded it to attacker-created GitHub repositories. GitHub disabled those repositories after an exposure window of about eight hours, but the article says attackers and others may have downloaded the data.
- Wiz observed more than 1,000 valid GitHub tokens, dozens of valid cloud credentials and npm tokens, and roughly 20,000 additional leaked files.
- Using tokens stolen in the first phase, an attacker reportedly made private repositories public. Wiz reported more than 400 affected users or organizations and over 5,500 repositories; the activity appeared suspended by August 29.
- The reported root cause was a GitHub Actions workflow flaw: unsanitized pull request titles were used with pull_request_target, enabling command execution with an elevated repository token.
- Affected Nx package versions are listed in the article. Recommended steps include removing them, upgrading, checking shell startup files and GitHub audit logs, and revoking and regenerating potentially exposed credentials.
Article Details
- Victim Organization
- Users and organizations whose GitHub repositories or developer systems were affected; specific victims were not named.
- Incident Type
- Software supply-chain attack involving malicious Nx npm package versions, credential and data theft, and subsequent publication of victims’ private GitHub repositories.
- Incident Date
- 2025-08-26
- Data Types Exposed
- Cryptocurrency wallet and keystore files
- GitHub tokens
- npm tokens and npm configuration contents
- SSH keys
- Cloud credentials
- API keys and environment-variable secrets
- Private repository contents
- Other sensitive files, including .env files
- Affected Records
- Over 400 users or organizations were impacted in the second phase, during which over 5,500 private repositories were made public. The first phase exposed over 1,000 valid GitHub tokens, dozens of valid cloud credentials and npm tokens, and roughly 20,000 additional files.
- Operational Impact
- The malware could cause system shutdowns on new terminal sessions by modifying shell startup files. Attacker-created repositories exposed stolen data publicly for around eight hours before GitHub disabled them. In the second phase, leaked tokens were used to make victims’ private repositories public. The article says the activity appeared suspended by August 29, 2025.
- Ransom Or Extortion
- No ransom demand or extortion activity was reported.
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA1 | 2379ac0e03b1a67c4ca5693136eff4945e644a91 | SHA1 hash identified as a telemetry.js variant associated with the malicious Nx package attack. |
| SHA1 | b4f20b39aa6df1002872f07973024d85aa49abaf | SHA1 hash identified as a telemetry.js variant associated with the malicious Nx package attack. |
| SHA1 | d2438106211ebd12c4f0a248848bc9864c97a3c0 | SHA1 hash identified as a telemetry.js variant associated with the malicious Nx package attack. |
| SHA1 | e5d1f3c45ee7cca6ae59cf64e0573050bbe136ec | SHA1 hash identified as a telemetry.js variant associated with the malicious Nx package attack. |
MITRE ATT&CK
T1059.004 · Unix ShellThe malware appended a shutdown command to Bash and Zsh startup files.T1195.002 · Compromise Software Supply ChainMalicious versions were published to the npm registry as part of a software supply-chain compromise.T1528 · Steal Application Access TokenThe attack harvested GitHub tokens and used leaked tokens in the second phase.T1552.001 · Credentials In FilesThe malware searched for sensitive files, including credentials and secrets stored in files such as .env.T1552.004 · Private KeysThe malware searched for SSH keys.T1565.001 · Stored Data ManipulationUsing leaked GitHub tokens, the attacker changed private repositories to public.T1567.001 · Exfiltration to Code RepositoryStolen data was uploaded to attacker-created GitHub repositories.
People
Vendors
Products
ClaudeIn the first phase of the attack, the malware leveraged AI command-line tools (including Claude, Gemini, and Q) to aid in their reconnaissance efforts, and then exfiltrated the stolen data to publicly accessibleGeminiIn the first phase of the attack, the malware leveraged AI command-line tools (including Claude, Gemini, and Q) to aid in their reconnaissance efforts, and then exfiltrated the stolen data to publicly accessibleGitHubmalware script designed to harvest sensitive developer assets, including cryptocurrency wallets, GitHub and npm tokens, SSH keys, and more. npm26, 2025, multiple malicious versions of the widely used Nx build system package were published to the npm registry. These versions contained a post-installation malware script designed to harvest sensitiveNxOn August 26, 2025, multiple malicious versions of the widely used Nx build system package were published to the npm registry. These versions contained a post-installation malware script designed to harvest sensitiveNX VSCode extensionfiles leaked. In many cases, the malware appears to have run on developer machines, often via the NX VSCode extension. We’ve also observed cases where the malware ran in build pipelines, such as Github Actions. QIn the first phase of the attack, the malware leveraged AI command-line tools (including Claude, Gemini, and Q) to aid in their reconnaissance efforts, and then exfiltrated the stolen data to publicly accessible