s1ngularity: supply chain attack leaks secrets on GitHub: everything you need to know

Summary

In late August 2025, attackers exploited a code-injection vulnerability in the Nx project's GitHub Actions workflow — an unsanitized pull-request title combined with a pull_request_target trigger — to steal an npm publishing token and publish malicious versions of the widely used Nx build system package (roughly six million weekly installs) to npm.^[1][2]

The compromised packages carried a post-install payload (telemetry.js) that searched Linux and macOS hosts for credentials, wallets, SSH keys, and tokens, and notably attempted to weaponize locally installed AI CLI tools (Claude, Gemini, and Amazon Q) to aid credential reconnaissance. Stolen data was exfiltrated to attacker-created public repositories within victims' own GitHub accounts.^[1][2]

A second phase used the GitHub tokens leaked in phase one to flip victims' private repositories to public, affecting over 400 users/organizations and more than 5,500 private repositories during an automated run between roughly August 28 and August 29, 2025.^[2]

Attack chain

1. Initial exploitation: Attackers abused a shell/code-injection flaw caused by an unsanitized pull-request title in an Nx workflow triggered by pull_request_target, allowing attacker-controlled commands to run with repository permissions and exposing a read/write GITHUB_TOKEN.^[1][2]
2. Token theft and malicious publication: Nx believes the attackers used the exposed GITHUB_TOKEN to trigger the publish.yml workflow against a malicious commit that modified the workflow to send the npm publishing token to a webhook; the stolen npm token was then used to publish compromised packages.^[1]
3. Payload execution on victim workstations: The compromised packages' post-install script (telemetry.js) ran on Linux and macOS, searching for wallets, keystores, .env files, and SSH keys and extracting gh auth tokens and npmrc content, and appending 'sudo shutdown -h 0' to shell profiles.^[1][2]
4. AI-tool-assisted reconnaissance: The payload invoked locally installed Claude, Gemini, and Amazon Q CLIs — using dangerous flags such as --dangerously-skip-permissions, --yolo, and --trust-all-tools — to build a secret inventory of the host.^[1][2]
5. Exfiltration: Collected data was double/triple base64 encoded and uploaded to attacker-created public repositories in victims' GitHub accounts named s1ngularity-repository, s1ngularity-repository-0, or s1ngularity-repository-1.^[1][2]
6. Second-phase repository exposure: Attackers reused the GitHub tokens leaked in phase one to make victims' private repositories public via single-threaded automation, impacting over 400 users/organizations and over 5,500 private repositories.^[2]

Disclosure timeline

How it works

The vulnerability was a code/shell-injection flaw: an Nx GitHub Actions workflow interpolated an unsanitized pull-request title into a command, and because the workflow was triggered by pull_request_target it ran with elevated permissions, providing a GITHUB_TOKEN with read/write access to the repository. This let a malicious PR title execute arbitrary commands with repository privileges.^[1][2]

The exposed GITHUB_TOKEN was believed to be used to trigger the publish.yml workflow against a malicious commit that modified the workflow to exfiltrate the npm publishing token to a webhook; that token then enabled publication of compromised packages. Although the workflow was removed from master, it remained present in older branches and could still be exploited.^[1][2]

The delivered payload (telemetry.js) executed as a post-install script only on Linux and macOS, harvested sensitive files and credentials, invoked local AI CLIs with permission-bypassing flags to build a secret inventory, base64-encoded stolen data multiple times, and exfiltrated it to attacker-created GitHub repositories.^[2]

Affected versions and patch status

Indicators of Compromise

Key takeaways

• This was one of the first widely documented supply-chain incidents in which malware attempted to weaponize locally installed AI development CLIs for credential reconnaissance, using flags like --dangerously-skip-permissions to bypass safeguards.^[1][2]
• Command injection through an untrusted pull-request title combined with pull_request_target is a well-known but recurring workflow misconfiguration that can yield repository-level tokens and cascade into full package-registry compromise.^[1][2]

Defensive actions

• Audit Nx package installations and rotate any exposed credentials (GitHub and npm tokens, SSH keys, .env secrets, cryptocurrency wallets).: The payload harvested and exfiltrated these assets from Linux and macOS developer workstations.^[1][2]
• Check for and remove attacker-created repositories named s1ngularity-repository, s1ngularity-repository-0, or s1ngularity-repository-1 in GitHub accounts, and inspect shell profiles for injected 'sudo shutdown -h 0' entries.: These are direct artifacts of the exfiltration and lockout behavior observed in the attack.^[2]
• Review whether previously private repositories were made public and re-secure them.: The second phase used leaked GitHub tokens to make over 5,500 private repositories public across more than 400 users/organizations.^[2]
• Avoid using pull_request_target with unsanitized inputs such as PR titles, and prune vulnerable workflows from older branches, not just master.: The root-cause workflow flaw persisted in older branches after removal from master and enabled arbitrary command execution with a read/write GITHUB_TOKEN.^[2]