Agent Incident RegistryAIR
v1 · updated 19 Oct 2026
In the wild Realized harm

s1ngularity: compromised Nx npm packages weaponised local Claude, Gemini and Q CLIs to hunt for secrets

AIR-2025-0125 AIR record · 2025-08-nx-s1ngularity
Open in dashboard About
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
scanned user systems for sensitive data, attempted to use local AI tools (like Claude and Gemini), and uploaded the results to a public GitHub repo via the GitHub CLI.nx.dev
The record
Disclosed
2025-08-27
Occurred
2025-08-26
Vendor
Nx (Nrwl)
Product
nx and Nx ecosystem npm packages; Claude Code, Gemini CLI and Amazon Q CLI on developer machines
Risk domain
Tool misuse › Supply chain vulnerabilities
Also touches
Credential theft, Data exfiltration channels
System type
Generative model
Who acted
Agent acted — the local Claude/Gemini/Q CLIs did the secret hunting themselves
Attack surface
Coding agent
Autonomy level
Semi-autonomous
Initial vector
Github actions workflow injection then npm token theft
Impact type
Credential theft, Data exfiltration, Private source code disclosure, Source code exposure
Confidence
High
Submitted by
EAI Internal
Crosswalk
OWASP Agentic Top 10 (2026)
ASI04 – Agentic Supply Chain Vulnerabilities
MITRE ATLAS
AML.T0040 – AI Supply Chain Compromise
NIST AI RMF
MAP 4.1
EU AI Act
Annex III §2
ISO/IEC
TR 24028; 42001; 23894
AIUC-1
B. Security
Scope
tool failure
Mitigation
Scan dependencies and container images for vulnerabilities; Use trusted sources.
Taxonomy
Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
~4 hours of malicious versions on npm; 2,349 distinct secrets leaked into attacker-created public GitHub repos in victims' own accounts
Capability abused
local_agent_cli_invocationfile_system_searchpermission_bypass_flagsshell_executionfilesystem_readautonomous_reconnaissancelocal_ai_cli_invocationfilesystem_enumerationsecret_discovery
Defense & remediation
Recorded defense
npm provenance signing (not enforced at install time); GitHub Actions default permissions
Guardrail kinds
Permission scope
Guardrail outcome
Silent
Fix shipped
packages unpublished; Nx moved to npm Trusted Publishers with OIDC and mandatory 2FA approval, and disabled pipeline runs for external contributors
Taxonomy & references
OWASP ASI05 Unexpected Code Execution (RCE)OWASP ASI06 Memory & Context PoisoningOWASP ASI04 Agentic Supply Chain VulnerabilitiesOWASP ASI03 Identity and Privilege AbuseATLAS AML.T0010npm_compromiseci_workflow_injectionagent_cli_abuseyolo_flagspostinstallagent_as_attack_tooldangerously_skip_permissionsyolo_flagpostinstall_malwaresecret_harvestingssh_key_theftagent_as_weaponsupply_chaincredential_theft
Curator notes
Widely described as the first supply-chain attack to turn developer AI assistants into the reconnaissance tool. The postinstall script invoked locally installed AI CLIs with permission-bypass flags (--yolo / --trust-all-tools / --dangerously-skip-permissions, per secondary coverage) to enumerate credential files. Root cause was a pull_request_target workflow echoing an unsanitised PR title, yielding a read/write token, then a workflow_dispatch publish. Leaked secrets skewed to GitHub PATs plus Google AI, OpenAI, AWS, OpenRouter and Anthropic keys. Also reported under the titles: 's1ngularity: malicious Nx npm packages weaponized Claude Code, Gemini CLI and Amazon Q CLI to hunt for developer secrets'; 's1ngularity: malicious Nx npm releases weaponised locally installed Claude Code, Gemini CLI and Amazon Q to hunt secrets'.
Supporting sources
Cite as
Enkrypt AI. "s1ngularity: compromised Nx npm packages weaponised local Claude, Gemini and Q CLIs to hunt for secrets". AIR, AIR-2025-0125. https://agentincident.vercel.app/i/AIR-2025-0125/ (accessed 2026-10-19).