They Weaponised Your AI CLI - Unpacking the Nx ‘s1ngularity’ npm Compromise

The talk examines the Nx 's1ngularity' incident, in which a compromised npm package was publicly available for several hours in August 2025. The speaker, a security operations manager, explains why package installs have long been trusted by default and how the malicious package used a post-install script to run on developer workstations as soon as it was installed.

The middle of the talk focuses on the payload. The script searched for Claude, Gemini and Amazon Q command-line tools and launched any it found with permission prompts disabled, feeding them a prompt that framed the task as an authorized penetration test. That prompt asked the assistant to inventory files in a temporary directory that could hold secrets. The collected material, including GitHub tokens, npm registry credentials and source code, was encoded several times and published to public GitHub repositories. The speaker also describes shell profile changes that forced a shutdown whenever a terminal was opened and wiped temporary files, which slowed responders. In the case shown, Claude declined the prompt.

The closing section explains how the activity was finally reconstructed. Command-line logging on macOS was the only source that revealed it, and few indicators of compromise were visible at the time. The takeaway for practitioners is to log process command lines, watch for AI assistants launched with permission-bypass flags, and treat dependency updates and locally installed tooling as possible attack paths.