Supply-chain attacksBriefChecked against a primary source
Nx “s1ngularity” (GHSA-cxm3-wv7p-598c)
Root cause: a `pull_request_target` workflow injection stole the npm token.
- Disclosed
What happened
- Affected: nx 20.9.0 to 20.12.0 and 21.5.0 to 21.8.0, plus @nx/* plugins.
- The postinstall payload used installed Claude Code, Gemini CLI and Amazon Q CLIs with permission-skipping flags to hunt secrets, then pushed them to public `s1ngularity-repository` repos.
- Scale: phase 1 exposed 1,000+ valid GitHub tokens and about 20k files. Phase 2 (28 to 29 Aug) made 5,500+ private repos public across 400+ users and orgs (Wiz).
Sources
- https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c
- https://www.wiz.io/blog/s1ngularity-supply-chain-attack
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.