ACVE-2026-0405

In the wild

exploited-itw · 2025-08-27 – 2025-08-28 · dfir, vendor

Description

What

The s1ngularity campaign used poisoned Nx package releases in the 20.9.0 through 21.8.0 range. The postinstall payload invoked claude, gemini, and q with permission-bypass flags, then enumerated and published secrets. This is a package compromise that weaponized installed agent CLIs; it is not evidence that victims had enabled yolo themselves.

Which configuration is exposed

The exposed configuration is a project that installs one of the reported Nx versions and has an agent CLI available to the postinstall process. The payload supplied the bypass flags and used the victim environment, so a normal approval setting does not neutralize the supply-chain condition.

How ACVE detects it

ACVE uses the flat dependency feature dependencies.nx rather than a plugins, MCP server, or tool array. The current discovery path records this feature only when dependency enrichment supplies it; absent enrichment is unknown. The matcher deliberately does not claim that every Nx installation reached a successful secret leak.

Fix

Remove the affected Nx release, rebuild dependencies from a trusted lock, revoke tokens and secrets in the project environment, and inspect public repositories created by the campaign. Review agent CLI logs for permission-bypass invocations and cross-reference Claude Code, Gemini CLI, and Q configurations.

Grounding needed

The GitGuardian and Wiz sources should be checked for the exact release wave and victim figures. The reported 1,079 systems and 2,349 secrets are retained as stated, not normalized with later public-repository counts.

This record is limited to the condition named in the public source: Nx s1ngularity postinstall invokes agent CLIs with bypass flags. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.

Configuration

features["dependencies.nx"] eq "installed"

Fix

Remove the poisoned Nx release and rotate credentials exposed to agent CLIs.

• Remove npm:nx@20.9.0-21.8.0.
• Reconfigure features["dependencies.nx"] to reviewed. Install only a reviewed dependency.

Validation

No validation entries recorded.

Grounding

No grounding checks recorded.

References

No references recorded.