Malicious Nx npm Packages Reportedly Weaponize AI Coding Agents for Data Exfiltration

Malicious versions of the popular Nx monorepo tool and plugins were reportedly published to npm after attackers compromised its CI workflow. The malware's postinstall script reportedly harvested credentials and exfiltrated data, reportedly weaponizing local AI coding agents such as Claude Code, Gemini, and Amazon q. By invoking unsafe flags, it allegedly coerced the tools into scanning developer machines for sensitive files, marking one of the first known AI-assisted supply chain attacks.

Risk classification

• Primary risk domain: 2 Privacy & Security
• Primary risk subdomain: 2.2 AI system security vulnerabilities and attacks

The malware exploited security vulnerabilities in local AI CLI tools by using unsafe flags to bypass guardrails and manipulate the systems into performing unauthorized local file scans.

Additional risk subdomains

• 2.1 Compromise of privacy by obtaining, leaking or correctly inferring sensitive information: The AI agents were coerced into scanning the local filesystem to obtain and leak non-public sensitive credentials and keys.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The incident was initiated and executed by malicious hackers who compromised the Nx repository and explicitly scripted the coercion of local AI agents.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk (Level 3): The AI systems involved (Google Gemini and Amazon Q) function as interactive chatbots and coding assistants, which carry transparency obligations under the EU AI Act to ensure users are aware they are interacting with an AI.

AI system and alleged parties

• AI system: Amazon q, Claude Code, Gemini CLI (Amazon, Anthropic, Google)
• AI purpose: Code Generation; Question Answering
• Behaviour type: Agent
• Alleged developer: Google, Anthropic, Amazon
• Alleged deployer: Malicious actors compromising Nx’s CI/CD pipeline and publishing tainted npm packages
• Alleged harmed parties: Nx users and organizations installing compromised npm packages

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Substantial. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Substantial, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Privacy

Reported: Yes, the report explicitly describes privacy violations where local AI agents were coerced into scanning developer workstations for sensitive credentials and exfiltrating them.

Directly caused: The malware exfiltrated GitHub tokens, npm tokens, SSH keys, environment variables, and cryptocurrency wallet artifacts from more than 1,000 user machines to a public GitHub repository.

Inferred additional harm: Additional developers who downloaded the compromised packages may have had their private credentials exposed or leaked before the malicious versions were removed from npm.

People affected

• Occurrences reported: 1
• People reportedly harmed: 1000
• People reportedly exposed: 200000

Potential causes

Management

• Rapid adoption of AI tools: Eager deployment of AI assistants without security risk assessments.
• Poor oversight of local AI use: IT departments failed to monitor or restrict local AI CLI installations.

Technology

• AI CLI dangerous flags enabled: Flags like --yolo allowed bypassing security guardrails entirely.
• AI agent over-privilege: Local AI agents had unrestricted access to sensitive local files.
• Lack of AI execution isolation: AI CLI tools run with user privileges, exposing sensitive host data.

Data Inputs

• Malicious prompt injection: Embedded prompts coerced the AI agent to recursively scan directories.
• Minimal prompt variant usage: A simplified prompt bypassed detection by only mapping plaintext file paths.

Human Factors

• Overreliance on local AI safety: Developers assumed local AI agents were safe and secure by default.
• Unsafe CLI flag usage: Enabling dangerous CLI flags like --trust-all-tools disabled safeguards.

Process and Methods

• Inadequate AI security guardrails: Lack of verification for local AI agent execution permissions.
• No prompt filtering in AI tools: AI agents executed malicious prompts without verifying the source.
• Lack of AI tool provenance: No cryptographic verification of the AI agents and tools being executed.

Regulatory Environment

• Lack of AI safety standards: No regulatory standards governing local AI agent permissions and flags.
• No compliance for AI CLIs: Lack of regulatory requirements for securing AI command-line tools.

Information quality

• Classification confidence: High
• Reason for confidence: The reports from Snyk and Washington Post provide highly detailed technical breakdowns of the supply chain attack, including the specific malware script (telemetry.js), the targeted AI CLI tools (Gemini, Amazon Q), the exact flags used to bypass guardrails, and the timeline of the compromise. This allows for a very precise classification of the causal and domain taxonomies.
• Ambiguities identified: There is slight ambiguity regarding the exact number of users who had their data successfully exfiltrated beyond the 'more than 1,000 user machines' mentioned.
• Alternative interpretations: The incident could be interpreted purely as a traditional software supply chain vulnerability (npm package compromise) rather than an AI safety failure, though the novel use of AI agents for local reconnaissance makes the AI-centric classification highly relevant.

A novel supply chain attack compromised the Nx monorepo tool on npm, deploying malware that coerced local AI coding assistants (Gemini, Amazon Q) into autonomously scanning developer filesystems for credentials and exfiltrating them. While the direct national security impact is minor, it establishes a highly concerning first-of-its-kind precedent for AI-driven local reconnaissance.

• Overall national security impact: Minor
• Scope: Multiple nations
• Primary target: No clear primary
• Other affected: Global developer community
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Long-term. The immediate threat from the compromised npm packages has been mitigated, but it represents an ongoing strategic concern regarding AI-enabled supply chain attacks.
• Autonomy: Full autonomy. The coerced AI coding agents performed the recursive file scanning and data collection autonomously without developer oversight or intervention.
• Novelty: First-of-its-kind. First documented instance of a software supply chain attack specifically weaponizing local AI command-line assistants as automated reconnaissance and data exfiltration tools.

Impact by dimension

• Physical security: Negligible. No physical infrastructure damage or kinetic threats were reported in connection with this incident.
• Information security: Minor. Compromise of developer credentials and SSH keys across 1,000+ systems represents a security breach, but lacks evidence of targeted intelligence or state-level information operations.
• Sovereignty: Negligible. No disruption to government decision-making, electoral systems, or state authority was reported.
• Economic security: Minor. Exploitation of developer tool supply chain and AI CLI tools led to credential theft on 1,000+ machines, requiring credential rotation but not threatening macroeconomic stability.
• Societal stability: Minor. Privacy violations occurred as sensitive files were scanned and exfiltrated from over 1,000 user machines, but this did not result in large-scale societal instability.