Nx Malware Turns AI Coding Tools Against Their Users

Software agent · Coding agents (Claude Code, Gemini CLI, Amazon Q) · Found first by user

Attackers published malicious versions of the Nx build tool that ran developers' installed Claude Code, Gemini CLI and Amazon Q tools to hunt for secrets. The malware turned developers' own AI coding tools into secret hunters by launching them with flags that skip every permission prompt.

Timeline of Nx Malware Turns AI Coding Tools Against Their Users: Aug 26, Malicious Nx 21.5.0 published; Aug 27, User reports it; npm pulls versions; Aug 28, Second wave exposes private repos; Sep 5, Nx publishes its postmortem. Below, the reporting rules that applied: CVE program, voluntary; California SB 53, not in force. FROM PUBLICATION TO POSTMORTEM SEP 1 AUG 26 Malicious Nx 21.5.0 published AUG 27 User reports it; npm pulls versions AUG 28 Second wave exposes private repos SEP 5 Nx publishes its postmortem REPORTING RULES AND THIS INCIDENT CVE program CVE-2025-10894 ASSIGNED VOLUNTARY California SB 53 TOOK EFFECT 2026 NOT IN FORCE
Agent class
Software
Developer
Nx; Anthropic, Google and Amazon
Victims
Developers who installed the bad Nx versions
Found first by
User
Date
Aug 2025
Secrets leaked
2,000+

What happened

Malware Ran Developers' AI Tools With Prompts Switched Off

  • Flags: the malware passed --dangerously-skip-permissions, --yolo and --trust-all-tools.
  • Exposure: more than 2,000 verified secrets leaked, and later waves made more than 6,700 private repositories public.
  • Entry: a GitHub Actions flaw let the attacker steal Nx's npm publishing token.
  • Refusals: about a quarter of Claude requests were refused.

Timeline

Live for Four Hours, Three Waves Over Five Days

Timeline
DateEventSource
August 26, 2025Malicious version 21.5.0 is published to npmStepSecurity
August 27, 2025A community member opens a GitHub issue and npm removes all affected versionsStepSecurity
August 28, 2025A second wave uses stolen credentials to make private repositories publicWiz
September 5, 2025Nx publishes its postmortemNx

Controls that failed

Permission Prompts Could Be Skipped by a Flag

Controls that failed
ControlCompanyWhat failed137AI page
CI workflow securityNxA workflow injection flaw let the attacker steal the npm tokenSupply Chain of Updates
Permission prompts in AI toolsUsers and tool makersCommand-line flags skipped every approval promptAccess and Authorization

Reporting

A CVE Was Assigned; No Breach Filing Was Found

Reporting rules and this incident
RuleStatusWhy
CVE programVoluntaryA CVE was assigned for the malicious versions
California SB 53Not in forceThe law took effect in January 2026

Every rule tracked is on Incident Reporting Rules and Registries.

Response

Nx Locked Down Publishing

  • Regulators and courts: None reported.
  • Remediation: Nx moved to npm trusted publishing with two-factor approval and provenance checks; npm removed the versions about four hours after publication.

Record

Incident Record

Incident ID
2025-08-NX-S1NGULARITY
AI Incident Database
Incident 1210
Sources
Nx postmortem (September 2025); StepSecurity (August 2025); Wiz (2025); NVD CVE-2025-10894
Last verified
October 2026