{
  "slug": "s1ngularity",
  "name": "Nx s1ngularity",
  "aliases": [
    "s1ngularity attack"
  ],
  "status": "dormant",
  "firstSeen": "2025-08-27",
  "lastSeen": "2025-08-28",
  "lastReviewed": "2026-09-20T00:00:00Z",
  "summary": "Nx postinstall code invoked agent CLIs with permission-bypass flags to steal secrets.",
  "description": "The attack affected 1,079 systems and exposed 2,349 secrets; later reporting described public repository flips and further secret exposure.",
  "platforms": [
    "npm",
    "github"
  ],
  "ttps": [
    {
      "framework": "atr",
      "id": "supply-chain"
    }
  ],
  "timeline": [
    {
      "date": "2025-08-27",
      "branch": "package",
      "id": "nx@20.9.0-21.8.0",
      "note": "Nx postinstall branch invoked Claude, Gemini, and Q.",
      "source": "https://blog.gitguardian.com/the-nx-s1ngularity-attack-inside-the-credential-leak/"
    },
    {
      "date": "2025-08-28",
      "branch": "report",
      "id": "1079-systems-2349-secrets",
      "source": "https://www.wiz.io/blog/s1ngularity-supply-chain-attack"
    }
  ],
  "iocs": [
    {
      "type": "package",
      "value": "nx@20.9.0-21.8.0",
      "firstSeen": "2025-08-27",
      "source": "https://blog.gitguardian.com/the-nx-s1ngularity-attack-inside-the-credential-leak/"
    }
  ],
  "exposedConfigurations": [
    {
      "label": "Agent tools include bash, a Claude Code or Gemini CLI harness, and never approval",
      "matcher": {
        "all": [
          {
            "some": "tools",
            "where": {
              "field": "name",
              "op": "eq",
              "value": "bash"
            }
          },
          {
            "field": "harness.id",
            "op": "in",
            "value": [
              "claude-code",
              "gemini-cli"
            ]
          },
          {
            "field": "approval",
            "op": "eq",
            "value": "never"
          }
        ]
      }
    }
  ],
  "advisories": [
    "ACVE-2026-0405"
  ],
  "incidents": [],
  "sources": [
    {
      "url": "https://blog.gitguardian.com/the-nx-s1ngularity-attack-inside-the-credential-leak/",
      "publisher": "GitGuardian",
      "date": "2025-08-27"
    },
    {
      "url": "https://www.wiz.io/blog/s1ngularity-supply-chain-attack",
      "publisher": "Wiz",
      "date": "2025-08-28"
    }
  ],
  "dormantAfterDays": 30
}