Nx NPM packages poisoned in AI-assisted supply chain attack

Nx, a widely used NPM project, was targeted in a supply‑chain attack where malicious package versions published to the NPM registry stole developer secrets (GitHub and NPM tokens, SSH keys, cloud credentials, and crypto wallet details) and the attacker publicly posted stolen data to GitHub; researchers report roughly 1,000 valid GitHub tokens and ~20,000 files exposed. The malware coerced locally installed generative AI CLIs to scan file systems for sensitive paths and also inserted a shutdown command into startup files; NPM removed the affected versions within an hour of being alerted.