s1ngularity: malware asks the AI tools on the laptop to find secrets
In shortMalicious versions of the Nx build package ran installed AI CLIs with their safety checks off to search the machine for secrets.
What happened
Malicious versions of the Nx package were published to npm on 26 August 2025, probably with a stolen publish token. A post-install script ran on every machine that installed them.
The script looked for Claude Code, Gemini CLI and Amazon's q CLI and ran them with flags such as --dangerously-skip-permissions and --trust-all-tools, asking them to find wallets, keys and other secrets. The results went to new public repositories in the victim's own GitHub account. Counts of leaked secrets differ between sources.
Why it worked
An AI CLI on a laptop is a capable search tool that runs as the user. The malware did not need its own scanner; it borrowed one, with the permission prompts turned off.
What EndLayer shows or does
- Available now
Permission modes: a session that ran outside the modes you accept, such as one with permission checks skipped, fails the check, even if it happened once. Roadmap →
- Available now
In Claude Code, the hook checks file reads and shell commands, and a secrets detector set to block stops a matched secret before it reaches the provider. Roadmap →
- Available now
Which devices have AI CLIs installed and which hold provider keys: the machines the malware could use. Roadmap →
- Not covered
Gemini CLI and the q CLI have no EndLayer hook, and the malicious npm package itself is out of scope.