Supply-chain attacks steal secrets. s1ngularity did something new: it turned your own AI tools into the thief. Between 26 and 28 August 2025, a compromised version of the popular Nx npm package became the first known supply-chain attack to actively hunt for installed AI CLIs and weaponize them.
Per Wiz and GitGuardian, the payload detected local Claude, Gemini and Amazon Q command-line tools and ran them with their most dangerous flags, --dangerously-skip-permissions, --yolo, to scan the developer’s machine for secrets. Roughly 2,349 secrets were exfiltrated across 190+ organizations and 3,000+ repositories.
TL;DR
- A compromised Nx npm package shipped a payload that looked for installed AI CLIs on the dev machine.
- It ran Claude / Gemini / Amazon Q with permission-skipping flags to do the secret-scanning work for it.
- ~2,349 secrets exfiltrated across 190+ orgs / 3,000+ repos.
- The AI CLI is a non-human identity with standing access to your files and tokens, that access is the attack surface.
What happened
Nx is a widely used monorepo build tool. When a trojanized version was installed, its post-install payload didn’t just grep for .env files itself. It checked whether the developer had an AI coding CLI installed, and if so, invoked it with flags that disable the very confirmation prompts meant to keep the tool safe, instructing it to find and collect credentials.
The CLIs did what they were built to do: read the filesystem, understand the repo, and act. They just did it for an attacker.
The genuinely new part
Plenty of npm attacks scan for secrets. What made s1ngularity a first is that it treated the developer’s AI tooling as leverage. An agentic CLI is a non-human identity with broad, standing access to your code, files and environment, and a permission model that can be told to step aside. That combination is a gift to an attacker: capability already installed, access already granted, guardrails already toggle-able.
The malware didn’t bring its own capability. It borrowed the capability you installed and trusted.
It’s the same lesson as the JADEPUFFER credential-harvest and the Salesloft OAuth reuse: the dangerous thing is standing, over-permissioned non-human access sitting where a foothold can reach it.
Anatomy of the path
nx-package # trojanized version on npm → postinstall # payload runs on install → ai-cli # claude / gemini / q, if present → --yolo scan # permission checks skipped, secrets collected → exfil # ~2,349 secrets, 190+ orgs
| Component | Role | Why it was abusable | Risk |
|---|---|---|---|
| npm package | Delivery | Trusted dependency, auto-run scripts | High |
| AI CLI | Weapon | Standing file access + skippable permissions | Critical |
| Local secrets | Target | Plaintext tokens on the dev machine | Critical |
The edge to cut
You can’t un-install your team’s AI tools, and you shouldn’t. But the attack has a clean breakpoint: the CLI’s ability to run in permission-skipping mode with reach to real secrets. Constrain what the non-human identity can touch, deny the dangerous flags in shared environments, and keep long-lived tokens off the machine, and the payload finds a tool that can’t reach anything worth stealing.
What good looks like
- Treat AI CLIs as non-human identities. Inventory them, scope them, and know what they can read.
- Deny permission-skipping flags in CI and shared machines, where a payload can invoke them silently.
- Get long-lived secrets off developer machines. Short-lived, scoped credentials cut the target out from under the scan.
- Map the reach of every installed agent, the tool is only as dangerous as what it can traverse to.
Your agents already know what they can reach. So does everyone who compromises the package sitting next to them. Elmoz shows you the same map first.