The s1ngularity npm attack stole credentials and tried to enlist developers’ AI tools

Stolen tokens helped the attack spread

In the s1ngularity campaign, malicious Nx package releases appeared on npm on August 26, 2025. The injected post-install malware searched developer environments for credentials and attempted to use installed Claude, Gemini, and Amazon Q command-line tools to inspect paths for sensitive files. Researchers reported the compromise the following day. Nx published a postmortem; StepSecurity and GitGuardian documented the attack mechanics.

GitGuardian counted 2,349 distinct leaked secrets across 1,079 repositories that contained at least one leaked secret. That figure covers the campaign as a whole. The AI command-line interactions were a separate reconnaissance technique, not the source of every leaked credential. GitGuardian later reported that 95 of 366 targeted LLM interactions wrote the requested inventory file.

Reduce what a package can reach

The incident shows how a package install can combine several forms of access: local files, environment credentials, package-publishing tokens, and developer AI tools. Each additional permission turns a compromised dependency into a broader foothold.

• Treat npm lifecycle scripts as executable code and review unexpected dependency changes
• Keep long-lived tokens out of broad process environments, especially in CI
• If a malicious version ran, audit publish history and repository changes, then rotate exposed credentials
• Keep AI command-line tools from acting on untrusted package output without approval