In the wild
Realized harm
Malicious Nx npm releases invoked local Claude Code, Gemini CLI and Amazon Q to hunt for and exfiltrate secrets
AIR-2025-0124 AIR record · 2025-08-nx-npm-weaponized-coding-agents
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
On August 26–27, 2025 (UTC), eight malicious Nx and Nx Powerpack releases were pushed to npm across two version lines and were live for ~5 hours 20 minutes before removal.snyk.io
The record
Disclosed
2025-08-27
Occurred
2025-08-26
Vendor
Nrwl (Nx), with Anthropic/Google/AWS agents abused
Product
Nx / Nx Powerpack npm packages; Claude Code, Gemini CLI, Amazon Q as weaponised tools
Risk domain
Tool misuse › Supply chain vulnerabilities
Also touches
Credential theft, Data exfiltration channels
System type
Generative model
Who acted
Agent acted — the local coding agents were invoked and scanned/exfiltrated the secrets
Attack surface
Coding agent
Autonomy level
Fully autonomous
Initial vector
Compromised ci workflow npm publish
Impact type
Credential theft, Data exfiltration, Supply chain compromise
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI04 – Agentic Supply Chain Vulnerabilities
- MITRE ATLAS
- AML.T0040 – AI Supply Chain Compromise
- NIST AI RMF
- MAP 4.1
- EU AI Act
- Annex III §2
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Scan dependencies and container images for vulnerabilities; Use trusted sources.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
eight malicious releases live ~5h20m on npm; thousands of developer machines
Capability abused
Defense & remediation
Recorded defense
agent permission prompts
Guardrail kinds
Human approval, Permission scope
Guardrail outcome
Silent
Fix shipped
malicious versions removed from npm; tokens rotated; Nx advisory published
Taxonomy & references
Curator notes
AI Incident Database incident 1210. The postinstall script shelled out to locally installed AI coding agents with permission-bypassing flags and asked them to locate secrets - one of the first observed cases of malware using the victim's own agent as its search capability. The originating CI workflow change is itself believed to have been Claude Code generated.
Supporting sources
Cite as
Enkrypt AI. "Malicious Nx npm releases invoked local Claude Code, Gemini CLI and Amazon Q to hunt for and exfiltrate secrets". AIR, AIR-2025-0124. https://agentincident.vercel.app/i/AIR-2025-0124/ (accessed 2026-10-19).