Executive brief
Malicious versions of Nx (a popular JavaScript build and monorepo management tool) and several of its plugin packages were published to npm on August 27, 2025. The compromised packages contained malware that scanned the file system, harvested credentials and environment variables, and automatically posted them to GitHub repositories created under the developer's own account. Developers who installed these versions had their GitHub tokens, npm tokens, and other sensitive credentials exposed to the attacker.
Technical details
The vulnerability stems from a bash injection flaw in a GitHub Actions workflow (using pull_request_target trigger) that lacked proper input sanitization on PR titles. An attacker injected malicious code that could execute with elevated permissions, leading to compromised GitHub secrets. The malware in the published npm packages performs filesystem scanning, credential collection from environment variables and shell profiles, and exfiltrates data by creating repositories named with "s1ngularity-repository" on the victim's GitHub account. The affected versions were removed from npm within hours of discovery (by 10:44 PM EDT on August 27, 2025). Developers must rotate all tokens and credentials immediately, verify GitHub audit logs for unauthorized repo creation, and remove any lingering malicious repositories.
Affected products
- Nrwl Nx 20.9.0, 20.10.0, 20.11.0, 20.12.0, 21.5.0, 21.6.0, 21.7.0, 21.8.0
- Nrwl @nx/devkit 20.9.0, 21.5.0
- Nrwl @nx/js 20.9.0, 21.5.0
- Nrwl @nx/workspace 20.9.0, 21.5.0
- Nrwl @nx/node 20.9.0, 21.5.0
- Nrwl @nx/eslint 21.5.0
- Nrwl @nx/key 3.2.0
- Nrwl @nx/enterprise-cloud 3.2.0
Timeline
- 2025-08-27: disclosed: Malicious versions published to npm
- 2025-08-27: other: Affected versions removed from npm
- 2026-07-28: other: Advisory withdrawn