s1ngularity nx Build System Compromise

discovered 2025-08-27

August 2025 compromise of the nx build system and @nx/js that stole credentials, SSH keys and wallet data from Linux and macOS developers and published the loot to attacker-created GitHub repositories.

Objective

Steal developer credentials, SSH keys and crypto wallets at scale via a trusted build tool.

Packages

npm nxattributed-to
npm @nx/jsattributed-to

Techniques

ttp T1195.001 Compromise Software Dependencies and Development Toolsuses
ttp T1059.007 JavaScriptuses
ttp T1552.001 Credentials In Filesuses
ttp T1041 Exfiltration Over C2 Channeluses
ttp T1552.004 Unsecured Credentials: Private Keysuses
ttp T1528 Steal Application Access Tokenuses
ttp T1071.001 Web Protocolsuses
ttp T1102 Web Serviceuses
ttp T1546 Event Triggered Executionuses
ttp T1485 Data Destructionuses

Read the full analysis →