A novel npm supply chain attack used hidden prompts to instruct local AI CLI tools to find and exfiltrate credentials and crypto-wallet keys
~1,400 users got hacked this way
Supply Chain Security Alert: Popular Nx Build System Package Compromised with Data-Stealing Malware - StepSecurity
Nx package on npm hijacked to steal cryptocurrency wallets, GitHub/npm tokens, SSH keys, and environment secrets - and is the first documented case of malware weaponizing AI CLI tools for reconnaissance and data exfiltration.
(www.stepsecurity.io)
s1ngularity: supply chain attack leaks secrets on GitHub: everything you need to know | Wiz Blog
Detect and mitigate a critical supply chain compromise affecting the Nx NPM Package. Organizations should act urgently.
wiz.io (www.wiz.io)
Nx npm Packages Compromised in Supply Chain Attack Weaponizi...
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malwa...
Socket (socket.dev)
