Malicious Nx npm Packages Reportedly Weaponize AI Coding Agents for Data Exfiltration

Summary

Malicious versions of the popular Nx monorepo tool and plugins were reportedly published to npm after attackers compromised its CI workflow. The malware's postinstall script reportedly harvested credentials and exfiltrated data, reportedly weaponizing local AI coding agents such as Claude Code, Gemini, and Amazon q. By invoking unsafe flags, it allegedly coerced the tools into scanning developer machines for sensitive files, marking one of the first known AI-assisted supply chain attacks.

Developers

• Anthropic
• Google
• Amazon

Deployers

• Malicious actors compromising Nx’s CI/CD pipeline and publishing tainted npm packages

Harmed parties

• Nx users and organizations installing compromised npm packages