s1ngularity: supply chain attack leaks secrets on GitHub: everything you need to know
· Source: wiz.io
In short
A malicious version of the Nx build system npm package was published on August 26, 2025, containing a post-installation script that harvested sensitive developer assets. The malware leveraged AI command-line tools for reconnaissance and exfiltrated data to public GitHub repositories. In a second phase, attackers used stolen tokens to make over 5500 private repositories public.
Read Original Article — Read the full article on the publisher’s site.
In the issue of week 35, 2025: AI-Powered Supply Chains Drive Resilience Amid Geopolitical Shifts
Tags: security, supply-chain, automation, vulnerability, cybersecurity, malware