A new supply chain attack, dubbed s1ngularity, targeted the popular JavaScript build system Nx, affecting thousands of developers and leading to the theft of numerous sensitive credentials. The attackers exploited a vulnerability in a GitHub workflow to steal a GITHUB_TOKEN, which was then used to publish malicious versions of the Nx package to the NPM registry. This sophisticated attack highlights the growing risk of supply chain vulnerabilities in open-source software, as well as the increasing sophistication of threat actors. The incident led to a swift response from the Nx maintainers, who revoked affected tokens and implemented new security measures, including two-factor authentication (2FA) and the Trusted Publisher mechanism, to prevent similar attacks in the future.
The s1ngularity attack began with a code injection vulnerability in an Nx GitHub workflow, introduced on August 21. Although the bug was quickly patched in the main branch, a threat actor exploited a pull request targeting an outdated branch to trigger the issue and steal a GITHUB_TOKEN with read/write permissions. This token was then used to trigger the publish.yml workflow, which contained an NPM token used to publish eight malicious versions of Nx and its plugins between 6:32 PM and 8:37 PM EDT on August 26. These malicious packages included a post-install script that executed a malicious telemetry.js file on Linux and macOS systems. The vulnerability also affected users of the Nx Console IDE extension, even if they did not have active Nx workspaces.
The malicious payload was a script designed to systematically search for and exfiltrate sensitive files and environment variables. The script looked for SSH keys, NPM tokens, GitHub tokens, API keys, and cryptocurrency wallet data. It also modified users’ shell startup files, adding shutdown commands that would crash the system when a new terminal session was opened. A particularly novel aspect of this attack was the use of AI tools like Claude and Gemini to assist with reconnaissance and data exfiltration, marking the first known instance of such a tactic in a supply chain attack. The harvested data was then encoded and uploaded to newly created public GitHub repositories with names like ‘s1ngularity-repository’, enabling the attackers to download the stolen information.
Cybersecurity firms Wiz and GitGuardian observed thousands of such repositories, containing a massive amount of stolen data. Despite GitHub’s efforts to delete or archive these repositories, they were online long enough for the attackers to download the exfiltrated information. According to GitGuardian, the hackers managed to steal 2,349 distinct secrets, including over a thousand valid GitHub tokens, dozens of valid cloud credentials, and NPM tokens. The attack affected developer machines, often via the NX VSCode extension, and even build pipelines like GitHub Actions. The prevalence of GitHub OAuth App Keys among the stolen secrets was linked to the functionality of Nx, which uses a GitHub application to facilitate interactions between NX Cloud and GitHub.
The s1ngularity attack serves as a stark reminder of the importance of rapid response and proactive security measures. The Nx maintainers’ swift action to revoke tokens and implement new security protocols was crucial in containing the damage. However, the incident also underscores the need for developers and organizations to be vigilant about the security of their supply chains. Cybersecurity experts advise that all stolen secrets should be revoked immediately, as any delay could lead to further compromise. This event highlights that the ability to rapidly detect, validate, and revoke compromised credentials has become a critical baseline for resilient software delivery in an age where supply chain attacks can weaponize leaked credentials within hours.
Reference:
