Gemini Cli

August 2025 1

• Critical✓ContainedAI · AI malware

  Compromised Nx npm packages ran victims' AI command-line tools to hunt for wallet and keystore files

  Around 26 August 2025 malicious versions of Nx, a widely used JavaScript build tool, were published to npm and stole GitHub and npm tokens on install. The malware also looked for installed AI command-line tools (Claude, Gemini and Amazon Q) and ran them to search the disk for crypto wallet and keystore files, .env files and SSH keys, then published the results to repos in the victim's own GitHub account. Wiz counted over 1,700 users with leaked secrets and over 6,700 private repos made public, but saw no successful crypto theft, partly because the AI tools often refused. Anyone who installed the bad versions should rotate tokens and move funds from wallet files on that machine.

  Nx build system on npm·Multiple EVM chains·Since Aug 26, 2025·updated 14 months ago