Security brief
Nx’s s1ngularity postmortem traces a package compromise to stolen publishing access
REVIEWThe August 2025 supply-chain attack used malicious package scripts to search developer machines for secrets.
What happened
Nx’s postmortem describes malicious package releases distributed during a roughly four-hour window on August 26, 2025. The investigation traced publishing-token theft to injection in a GitHub Actions workflow.
The payload searched for secrets and attempted to use locally available AI command-line tools to assist its work. That behavior does not establish a breach of the AI providers. Nx said Nx Cloud was not affected.
Nx described moving toward trusted publishing and stronger release controls. Teams should check the postmortem’s affected-package details against installation records, investigate exposed developer credentials and review permissions in release automation.
Next step
Compare installation records with the postmortem and investigate potentially exposed secrets.
What remains unknown
- Open question
- The sources reviewed do not establish whether your deployment was exploited.
Source references
-
NX.