Sep 3, 2025
0 new drains, 1 update.
Updated
-
Compromised Nx npm packages ran victims' AI command-line tools to hunt for wallet and keystore files
Around 26 August 2025 malicious versions of Nx, a widely used JavaScript build tool, were published to npm and stole GitHub and npm tokens on install. The malware also looked for installed AI command-line tools (Claude, Gemini and Amazon Q) and ran them to search the disk for crypto wallet and keystore files, .env files and SSH keys, then published the results to repos in the victim's own GitHub account. Wiz counted over 1,700 users with leaked secrets and over 6,700 private repos made public, but saw no successful crypto theft, partly because the AI tools often refused. Anyone who installed the bad versions should rotate tokens and move funds from wallet files on that machine.
Nx build system on npm·Multiple EVM chains·Since Aug 26, 2025·