Supply Chain Attack Hits Nx NPM Package with 4.6M Weekly Downloads
· Source: cyberinsider.com
In short
A sophisticated supply chain attack has compromised the Nx NPM package, an AI-driven monorepo build system with 4.6 million weekly downloads, leaking sensitive developer secrets to publicly accessible GitHub repositories. The breach occurred through malicious updates that weaponized AI CLI tools and post-install scripts to harvest credentials and exfiltrate data. Researchers from Wiz and StepSecurity disclosed the incident, noting the malware exploited tools like Anthropic's Claude and Google Gemini to extract filesystem data and upload it to attacker-controlled repositories.
Read Original Article — Read the full article on the publisher’s site.
In the issue of week 35, 2025: AI-Powered Supply Chains Drive Resilience Amid Geopolitical Shifts
Tags: security, cybersecurity, automation, vulnerability, development, attack