Poisoned Nx npm packages turn developers' AI coding CLIs into secret-hunting tools
Attackers stole Nx's npm publishing token through a GitHub Actions injection flaw and published malicious versions of Nx packages for about four hours on 26 August 2025. A post-install script harvested secrets and launched any locally installed Claude, Gemini or Amazon Q CLI with permission-skipping flags, prompting it to search the file system for sensitive files, then uploaded the results to public GitHub repositories. In a second phase, stolen GitHub tokens were used to make more than 6,700 private repositories public.
Wiz found that roughly half of victims had at least one AI CLI installed, that almost a quarter of Claude interactions were refused, and that the AI-driven search exfiltrated data successfully in under a quarter of cases; it counted over 20,000 leaked files in its sample. Nx moved to npm Trusted Publishers with OIDC and manual 2FA approval for releases.
What would have stopped it
Do not let scripts launch AI CLIs with permission checks disabled; keep agent approval prompts non-bypassable by default.
Guardrails
- G1 Least privilege Failed Hijacked CLIs could recursively scan the user's file system for sensitive files.
- G2 Human confirmation Failed Malware launched Claude with --dangerously-skip-permissions and Gemini with --yolo, bypassing approval prompts.
- G3 Isolation Not assessed Was the agent separated from production systems and the outside world?
- G4 Instruction integrity Partial Almost a quarter of Claude interactions were refused; Gemini refused at a lower rate.
- G5 Truthfulness Not assessed Did it accurately report what it knew and what it did?
- G6 Limits Not assessed Was there a cap on rate, spend, volume or scale?
- G7 Oversight Failed The CLIs were run non-interactively from an npm post-install script, without the user's knowledge.
- G8 Recovery Partial GitHub took leaked repositories offline, but secrets were already exposed and many stayed valid.
Sources
-
“The malicious packages ran a post-install script that scanned user systems for sensitive data, attempted to use local AI tools (like Claude and Gemini), and uploaded the results to a public GitHub repo via the GitHub CLI.”
-
“Kurmi said the abuse of locally installed generative AI CLIs, such as Claude, Gemini, and Q, presented a novel method of attack to bypass defenses.”
-
“The malware also abused locally configured AI CLIs to identify additional files for exfiltration.”
Confidence 92% comes from these sources alone. How we score
History
- 14 Oct 2026Entered in the register with 3 sources