{
 "id": "TR-2026-008",
 "status": "published",
 "title": "s1ngularity: npm-borne malware drives developers' own AI CLIs (Claude, Gemini, Q) to hunt for secrets",
 "date": "2025-08-26",
 "window": "Malicious Nx packages published 26 Aug 2025; GitHub disabled the exfil repos 27 Aug; a second wave ran 28-29 Aug",
 "ai_role": "attacker",
 "category": "incident",
 "summary": "Malicious versions of the Nx build package shipped a postinstall script that, on developer machines and in CI, invoked locally installed AI command-line agents — Claude, Gemini and Amazon Q — with permission-skipping flags (--dangerously-skip-permissions, --yolo, --trust-all-tools) and prompted them to enumerate the filesystem for wallets, keystores, .env files and SSH keys. Wiz observed the AI-assisted reconnaissance succeed in hundreds of cases (provider guardrails sometimes intervened). Harvested tokens were base64-encoded into attacker-created public GitHub repos; a second wave used leaked tokens to flip victims' private repositories public. This is a trace of AI agents turned into the attacker's reconnaissance tool.",
 "attacker": {
  "description": "Unknown operator; malware that weaponised the victims' installed AI CLIs"
 },
 "defender": {
  "description": "GitHub and npm — disabled the exfil repos and removed the packages; vendors' agent guardrails caught some runs"
 },
 "scale": "Phase one: 1,000+ GitHub tokens and ~20,000 files; phase two: 400+ users/orgs and 5,500+ repos made public (Wiz)",
 "impact": "AI-assisted credential and secret theft at scale, plus forced exposure of private repositories",
 "tactics": [
  "TA0043",
  "TA0006",
  "TA0009",
  "TA0010"
 ],
 "timeline": [
  {
   "date": "2025-08-26",
   "text": "Malicious Nx versions published to npm; the postinstall script prompts installed AI CLIs to find secrets",
   "tier": 2,
   "source": "1"
  },
  {
   "date": "2025-08-27",
   "text": "GitHub disables the s1ngularity exfiltration repositories (~8-hour exposure window)",
   "tier": 2,
   "source": "1"
  },
  {
   "date": "2025-08-28",
   "text": "A second wave uses leaked tokens to make victims' private repositories public (400+ orgs, 5,500+ repos)",
   "tier": 2,
   "source": "1"
  }
 ],
 "lessons": [
  "A capable AI CLI on a developer's machine becomes an attack tool once code can invoke it — treat permission-skipping flags as a privilege, not a convenience.",
  "Provider guardrails refused some of the malicious prompts; that layer is worth keeping, but it is probabilistic, not a control.",
  "Secrets reachable to a shell are reachable to an agent the shell can launch; scope what a developer agent is allowed to read."
 ],
 "models_named": [
  {
   "name": "Claude",
   "role": "attacker",
   "note": "invoked by the malware with --dangerously-skip-permissions"
  },
  {
   "name": "Gemini",
   "role": "attacker",
   "note": "invoked with --yolo"
  },
  {
   "name": "Amazon Q",
   "role": "attacker",
   "note": "invoked with --trust-all-tools"
  }
 ],
 "related_agents": [
  "anthropic-claude-code",
  "google-gemini-cli",
  "aws-amazon-q-developer"
 ],
 "vendor_response": "GitHub disabled the repos; npm removed the packages; Nx published clean releases and guidance",
 "sources": [
  {
   "title": "s1ngularity: supply chain attack leaks secrets on GitHub: everything you need to know",
   "url": "https://www.wiz.io/blog/s1ngularity-supply-chain-attack",
   "outlet": "Wiz",
   "date": "2025-08-27"
  },
  {
   "title": "The s1ngularity attack: When attackers prompt your AI agents to do their bidding",
   "url": "https://www.okta.com/blog/threat-intelligence/the-s1ngularity-attack--when-attackers-prompt-your-ai-agents-to/",
   "outlet": "Okta Threat Intelligence",
   "date": "2025-09"
  }
 ],
 "reviewer": null,
 "checked_on": null
}