{
 "public_id": "AIR-2025-0124",
 "incident_id": "2025-08-nx-npm-weaponized-coding-agents",
 "date_disclosed": "2025-08-27",
 "date_occurred": "2025-08-26",
 "title": "Malicious Nx npm releases invoked local Claude Code, Gemini CLI and Amazon Q to hunt for and exfiltrate secrets",
 "class": "in_the_wild",
 "attack_surface": "coding_agent",
 "initial_vector": "compromised_ci_workflow_npm_publish",
 "agent_capability_abused": [
  "local_agent_cli_invocation",
  "filesystem_scan",
  "dangerous_permission_flags"
 ],
 "target_product": "Nx / Nx Powerpack npm packages; Claude Code, Gemini CLI, Amazon Q as weaponised tools",
 "target_vendor": "Nrwl (Nx), with Anthropic/Google/AWS agents abused",
 "autonomy_level": "fully_autonomous",
 "impact_realized": true,
 "impact_type": [
  "credential_theft",
  "data_exfiltration",
  "supply_chain_compromise"
 ],
 "blast_radius": "eight malicious releases live ~5h20m on npm; thousands of developer machines",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI04",
   "ASI02"
  ],
  "mitre_atlas": [],
  "labels": [
   "ai_supply_chain",
   "agent_as_payload",
   "dangerous_flag_abuse",
   "first_of_kind"
  ]
 },
 "defense_present": "agent permission prompts",
 "defense_bypassed": true,
 "fix_shipped": "malicious versions removed from npm; tokens rotated; Nx advisory published",
 "primary_sources": [
  "https://snyk.io/blog/weaponizing-ai-coding-agents-for-malware-in-the-nx-malicious-package/",
  "https://incidentdatabase.ai/cite/1210"
 ],
 "verified_quote": "On August 26–27, 2025 (UTC), eight malicious Nx and Nx Powerpack releases were pushed to npm across two version lines and were live for ~5 hours 20 minutes before removal.",
 "confidence": "high",
 "notes": "AI Incident Database incident 1210. The postinstall script shelled out to locally installed AI coding agents with permission-bypassing flags and asked them to locate secrets - one of the first observed cases of malware using the victim's own agent as its search capability. The originating CI workflow change is itself believed to have been Claude Code generated.",
 "risk_category": "security_fraud",
 "risk_secondary": [
  "privacy"
 ],
 "risk_subcategory": "Supply Chain Compromise",
 "risk_sub_secondary": [
  "Credential & Secret Theft"
 ],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": false,
 "agency_reason": "the local coding agents were invoked and scanned/exfiltrated the secrets",
 "vector_family": "other",
 "vector_detail": "compromised_ci_workflow_npm_publish",
 "guardrail_kind": [
  "human_approval",
  "permission_scope"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [
   1210
  ],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI04",
 "agent_framework": "unknown",
 "model_provider": "multiple",
 "model_name": "",
 "detection_mechanism": "external_researcher",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "supply_chain_vulnerabilities",
 "eai_domain": "tool_misuse",
 "eai_secondary": [
  "credential_theft",
  "data_exfiltration_channels"
 ],
 "eai_reason": "subcategory: Supply Chain Compromise",
 "asi_curated": [],
 "asi_scope": "in_scope",
 "asi_provenance": "rule",
 "asi_reason": "ASI04 (eai_category=supply_chain_vulnerabilities); ASI02 (impact=tool_misuse)",
 "submitted_by": "EAI Internal"
}