s1ngularity

s1ngularity is the name used for a multi-phase August 2025 npm supply-chain intrusion centered on the Nx open-source build system and monorepo management tool. Malicious Nx packages were published to npm after a maintainer token was compromised. The campaign targeted the software supply chain and developer environments, and reporting cited compromise of more than 2,000 GitHub accounts and 7,200 repositories across three phases between August 26 and August 31, 2025. The first phase involved malicious Nx packages that exposed more than 2,000 secrets and 20,000 files; the second phase used leaked GitHub tokens to impact 480 accounts and expose 6,700 private repositories; and a final phase on August 31 targeted a single organization and exposed 500 additional private repositories. The malware executed during package installation, stole developer credentials, and exfiltrated data by creating public GitHub repositories named with the s1ngularity label, including s1ngularity-repository. Reported exposed material included GitHub tokens, SSH keys, configuration files, and npm tokens. The payload also exploited locally installed AI platform CLI tools for reconnaissance and data discovery, and researchers noted that prompt modifications across phases affected the malware’s success. Wiz assessed later Shai-Hulud activity as directly downstream of the late-August 2025 s1ngularity/Nx compromise, with initial GitHub token theft enabling npm token theft and broader package poisoning. Aliases directly mentioned in the content are s1ngularity and Nx (s1ngularity). No high-confidence nation-state attribution is provided in the supplied content.