Nx NPM packages poisoned in AI-assisted supply chain attack
· Source: theregister.com
In short
Nx, an open source codebase management platform, was targeted in a software supply chain attack where malicious NPM packages were uploaded to steal developer credentials. The attack utilized a novel technique by coercing locally installed generative AI CLIs like Claude and Gemini to assist in reconnaissance. Over 1,000 valid GitHub tokens were leaked, and researchers highlight this as one of the first documented cases of AI tool abuse in such attacks.
Read Original Article — Read the full article on the publisher’s site.
In the issue of week 35, 2025: AI-Powered Supply Chains Drive Resilience Amid Geopolitical Shifts
Tags: cybersecurity, supply-chain, automation, npm, attack, reconnaissance