{"id":54223,"date":"2025-08-28T07:47:18","date_gmt":"2025-08-28T11:47:18","guid":{"rendered":"https:\/\/www.kaspersky.com\/blog\/?p=54223"},"modified":"2025-08-28T07:47:18","modified_gmt":"2025-08-28T11:47:18","slug":"nx-build-s1ngularity-supply-chain-attack","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com\/blog\/nx-build-s1ngularity-supply-chain-attack\/54223\/","title":{"rendered":"Serious NX build compromise \u2014 what you need to know about the s1ngularity attack"},"content":{"rendered":"

Packages of the popular build platform and CI\/CD optimization system, Nx, were compromised on the night of August 26-27<\/a>. A malicious script was added to the system\u2019s packages, which, according to npm repository statistics, have more than five million weekly downloads. Thousands of developers that use Nx to accelerate and optimize application development had their sensitive data stolen: npm and GitHub tokens, SSH keys, cryptocurrency wallets, and API keys were uploaded to the public GitHub repositories. The massive leak of secrets poses a long-term threat of supply chain attacks<\/a>: even when malicious packages are removed from affected systems, attackers may still have the ability to compromise applications created by these thousands of developers.<\/p>\n

Attack and response chronology<\/h2>\n

The attackers used a compromised token issued for one of the Nx package maintainers to publish multiple malicious versions of the Nx package and its plugins in the two hours between 22:32 UTC, August 26 and 0:37 UTC, August 27. Another two hours later, the npm platform removed all compromised versions of the packages, and another hour later, the Nx owners revoked the stolen token \u2014 so attackers lost access to the Nx repository. Meanwhile, thousands of public repositories containing data stolen by the malicious script began appearing on GitHub.<\/p>\n

At 9:05 UTC on August 27, GitHub responded by making all leaked repositories private and unsearchable. Nevertheless, the stolen data was publicly available for more than nine hours, and was downloaded multiple times by groups of cybercriminals and researchers. A total of 19 compromised versions of Nx and plugins were released:<\/p>\n