Malicious actors compromising Nx’s CI/CD pipeline and publishing tainted npm packages

Incidents involved as Deployer

Incident 12102 Report
Malicious Nx npm Packages Reportedly Weaponize AI Coding Agents for Data Exfiltration

2025-08-21

Malicious versions of the popular Nx monorepo tool and plugins were reportedly published to npm after attackers compromised its CI workflow. The malware's postinstall script reportedly harvested credentials and exfiltrated data, reportedly weaponizing local AI coding agents such as Claude Code, Gemini, and Amazon q. By invoking unsafe flags, it allegedly coerced the tools into scanning developer machines for sensitive files, marking one of the first known AI-assisted supply chain attacks.

Related Entities

Anthropic

Incidents involved as Developer

Incident 1210
2 Reports
Malicious Nx npm Packages Reportedly Weaponize AI Coding Agents for Data Exfiltration

Google

Incidents involved as Developer

Incident 1210
2 Reports
Malicious Nx npm Packages Reportedly Weaponize AI Coding Agents for Data Exfiltration

Amazon

Incidents involved as Developer

Incident 1210
2 Reports
Malicious Nx npm Packages Reportedly Weaponize AI Coding Agents for Data Exfiltration

Nx users and organizations installing compromised npm packages

Incidents Harmed By

Incident 1210
2 Reports
Malicious Nx npm Packages Reportedly Weaponize AI Coding Agents for Data Exfiltration

Nx (monorepo tool and plugins)

Incidents implicated systems

Incident 1210
2 Reports
Malicious Nx npm Packages Reportedly Weaponize AI Coding Agents for Data Exfiltration

npm registry

Incidents implicated systems

Incident 1210
2 Reports
Malicious Nx npm Packages Reportedly Weaponize AI Coding Agents for Data Exfiltration

Claude Code CLI

Incidents implicated systems

Incident 1210
2 Reports
Malicious Nx npm Packages Reportedly Weaponize AI Coding Agents for Data Exfiltration

Google Gemini CLI

Incidents implicated systems

Incident 1210
2 Reports
Malicious Nx npm Packages Reportedly Weaponize AI Coding Agents for Data Exfiltration

Amazon q CLI

Incidents implicated systems

Incident 1210
2 Reports
Malicious Nx npm Packages Reportedly Weaponize AI Coding Agents for Data Exfiltration

GitHub

Incidents implicated systems

Incident 1210
2 Reports
Malicious Nx npm Packages Reportedly Weaponize AI Coding Agents for Data Exfiltration