Poisoned Pipeline / Incidents / AS74
Nx s1ngularity (stolen npm token via Actions injection)
npmGitHub ActionsAI coding agentsCI/CD SaaSGit / GitHubDeveloper workstation
On 26 August 2025 attackers published malicious versions of nx and
several @nx/* packages for about four hours. Nx’s post-mortem: a
pull_request_target workflow echoed unsanitized PR titles, repository
Actions permissions were still read/write, and publish.yml allowed
workflow_dispatch. That let an external PR steal a GitHub token, plant
a branch, trigger publish, and exfiltrate NPM_TOKEN. Stolen token
bypassed CI; packages lacked npm provenance. postinstall scanned the
host, tried local AI CLIs, and uploaded loot to public GitHub repos via
gh. ~6M weekly installs. Primary: nx.dev post-mortem and GHSA-cxm3-wv7p-598c.
Mapped techniques
- T0118 Command injection
- T0202 Inadequate CI/CD workflow permissions
- T0166 Trigger pipeline execution
- T0140 Harvest tokens from environment variables
- T0121 Compromised legitimate artifact
- T0206 Forge or omit build provenance
- T0151 Installation scripts
- T0168 Exfiltration to code repositories
supply-chain actions injection to stolen npm token
Unsanitized PR title in a pull_request_target workflow.
Repo still on GitHub’s old read/write Actions default.
workflow_dispatch used via API to run publish.yml on a planted branch.
NPM_TOKEN stolen from the publish job.
nx 20.9–21.8 and matching @nx/* versions, no provenance.
Detection clue — malicious publishes were unsigned.
postinstall scanned the host and invoked local AI tools.
Loot uploaded to public GitHub repos via GitHub CLI.
Sources
- https://nx.dev/blog/s1ngularity-postmortem
- https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c
- https://safedep.io/nx-build-system-compromise
- https://socket.dev/blog/nx-packages-compromised
- https://www.cisa.gov/news-events/alerts/2026/05/28/supply-chain-compromises-impact-nx-console-and-github-repositories