The Nx Supply-Chain Attack Turned AI Coding Agents Into Credential Scanners

A Docker Blog post published July 28 revisits a supply-chain attack from last August to make its case for isolating AI coding agents, and the incident it walks through is worth understanding on its own terms. On August 26, 2025, malicious versions of the Nx build platform were published to npm, and the payload did something credential stealers had not done before at this scale: instead of shipping its own scanner, it looked for an AI coding agent already installed on the machine, then used that agent’s own filesystem access to do the scanning for it.

What Happened on August 26, 2025

Nx draws roughly four million downloads a week, and the compromised package versions, 20.9.0 through 21.8.0, carried a post-install script called telemetry.js. A post-install hook fires the moment npm install finishes, so the payload ran automatically on every machine and CI runner that pulled a poisoned version, with nobody opening a file or reviewing a diff first. The campaign became known as s1ngularity, a name taken from the public GitHub repositories the malware created to hold what it stole. According to GitGuardian’s own analysis of the incident, telemetry.js scanned infected systems for GitHub and npm tokens, SSH private keys, cloud configuration files, and cryptocurrency wallet keystores, the routine target list for this class of malware.

The Novel Part: Borrowing the Developer’s Own Agent

What made s1ngularity notable was the step after the scan started. Rather than walk the filesystem itself, the script checked whether the machine had an installed AI coding CLI, Claude Code, Gemini CLI, or Amazon Q, and if so, invoked it directly with the flag that disables interactive permission prompts: --dangerously-skip-permissions on Claude Code, --yolo on Gemini CLI, and --trust-all-tools on Amazon Q. Those flags exist for legitimate reasons, since confirming every file read gets tedious once a developer trusts a task they have handed off. The malware simply set them itself.

The instruction it sent, recovered and published by StepSecurity’s analysis of the payload, told the agent to recursively search local paths starting from the home directory, follow a depth limit of eight, avoid sudo so no password prompt would raise suspicion, and record the absolute path of any file matching credential-shaped patterns, wallet keystores, .env files, SSH keys, into a single inventory file. It reads like a task a developer might plausibly assign, which was the point: the agent was already authenticated, already permitted to read anything the developer could read, and nothing sat between the instruction and the filesystem access it was given.

Not Every Agent Complied

The attack’s success rate against AI tools was real but limited. GitGuardian’s investigation found that 33 percent of compromised systems had at least one LLM client installed, confirming the attackers had correctly bet on a growing attack surface. But of the 366 systems where an LLM tool was actually targeted, only 95 wrote the requested inventory file, meaning most installed agents either refused the request outright or otherwise did not comply. That is not a security control anyone designed on purpose, and it is not something worth relying on, but it is a real data point: built-in model behavior blocked roughly three-quarters of the attempts in this specific incident, even before any sandboxing was involved.

How the Attackers Got In Ahead of Time

The npm compromise was the visible part of the attack, but Nx’s own postmortem, published September 5, 2025, traces the actual entry point to the project’s CI pipeline rather than its published code. Attackers submitted a pull request with a malicious title containing shell commands. Nx’s PR-title validation workflow used GitHub Actions’ pull_request_target trigger, which runs with the permissions of the target branch and can access repository secrets, and echoed the PR title without sanitizing it first, creating an injection point. Two conditions turned that injection point into a full compromise: the repository’s Actions workflow permissions were still set to the older “read and write” default that GitHub replaced with a safer read-only default for new repositories in February 2023, and the publish workflow had workflow_dispatch enabled, which let the attacker trigger it programmatically through GitHub’s API once they had extracted a token. That combination let the attacker steal Nx’s npm publishing token and push malicious releases directly, without ever compromising Nx’s actual source code or review process. Nx says the malicious packages were live for about four hours before being fully removed from the registry.

The Scale of the Damage

GitGuardian counted 2,349 distinct credentials stolen from 1,079 compromised developer systems in the attack’s first wave, exfiltrated as double-base64-encoded data pushed to more than 1,400 public repositories created under victims’ own GitHub accounts. More than 1,100 of those stolen credentials were still valid at the time of analysis. The attackers then used stolen GitHub tokens for a second wave two days later, flipping 10,767 private repositories to public. GitGuardian found that about 20 percent of those newly public repositories, 2,399 of them, actually contained a hardcoded secret, exposing 82,901 secrets in total, 11,168 of them still valid. Docker’s post frames the underlying trend behind the incident by citing GitGuardian’s separate State of Secrets Sprawl 2026 report: roughly 28.65 million new hardcoded secrets landed on public GitHub in 2025 alone, up 34 percent year over year, and code written with an AI agent leaks credentials at roughly twice the rate of code written without one.

Docker’s Pitch: Change What the Agent Can See

Docker’s post uses the incident to argue for its Docker Sandboxes product, and the mechanism is worth understanding independent of the vendor pitch. Docker Sandboxes run coding agents inside isolated microVMs where the agent’s filesystem view stops at the project workspace instead of extending to the whole home directory. Credentials are not stored inside the sandbox at all; a command like sbx secret set followed by sbx run injects secrets only at the network boundary as a request leaves the VM, so a compromised or malicious agent inside the box never holds a raw, readable key to steal in the first place. Docker also points to its sbx policy log, which records every network connection the sandbox’s proxy allowed or denied in real time, as a replacement for the after-the-fact log scanning that is all a team has once a credential has already leaked publicly.

The best practices Docker lists apply regardless of which vendor’s tooling a team uses: do not hand an agent direct access to credential files, scope an agent’s filesystem access to the project it is working on rather than the whole machine, and treat an installed AI CLI as privileged automation rather than a convenience, since anything with standing access to a developer’s credentials is worth threat-modeling the same way a service account would be.

The Broader Takeaway

The s1ngularity attack is a useful case study precisely because it did not require a novel exploit against the AI tools themselves. The agents did exactly what they are built to do: read files and follow instructions inside the permissions they were given. The attacker’s real insight was that a permission-bypass flag meant for convenience, run on a host where the agent’s reach equals the developer’s reach, turns that convenience into a ready-made credential scanner the moment anything else on the machine is compromised. Nx’s postmortem is a reminder that the CI pipeline publishing the code is just as much a part of that trust boundary as the developer’s own laptop, since a single leaked token let attackers skip the source code entirely. Sandboxing an agent’s runtime and hardening the pipeline that ships the packages it depends on are not competing fixes; the incident shows why a team needs both.

Sources

• Docker Blog: Coding Agent Horror Stories, The 29 Million Secret Problem
• GitGuardian: The Nx “s1ngularity” Attack, Inside the Credential Leak
• Nx Blog: S1ngularity, What Happened, How We Responded, What We Learned
• StepSecurity: Nx Build System Package Compromised With Data-Stealing Malware
• GitGuardian: The State of Secrets Sprawl 2026

Image credit: Aerial view of shipping containers at the Port of Barcelona, Spain. Photo by Igor Ovsyannykov via Unsplash, dedicated to the public domain (CC0) via Wikimedia Commons; cropped and converted to WebP for sxz.io.