s1ngularity's Aftermath: AI, TTPs, and Impact in the Nx Supply Chain Attack

Wiz Research details the 's1ngularity' supply-chain attack in which a compromised npm token for Nx packages was used to publish malicious package versions that exfiltrated thousands of secrets and private repositories across multiple phases; the malware harvested environment variables, GitHub and npm tokens, and leveraged locally installed AI CLIs to enumerate potentially sensitive files, resulting in widespread credential exposure and follow-on repository disclosures, with guidance on GitHub audit log investigations and observed TTPs.