Nx recently fell victim to a software supply chain attack within the NPM ecosystem, with multiple malicious packages uploaded to the NPM registry. Researchers from Wiz found that these compromised packages contained malware aimed at stealing sensitive developer information, including GitHub and NPM tokens, SSH keys, and cryptocurrency wallet details. The attack allowed stolen credentials to be posted as public GitHub repositories.
With Nx boasting over 24 million monthly downloads, the incident underscores the growing sophistication of supply chain attacks, especially with AI tools potentially being used in the process. Wiz reported over 1,000 GitHub tokens and 20,000 files were exposed. Although Nx maintainers used two-factor authentication (2FA), it did not prevent the attack’s success. This incident serves as a critical reminder for developers to monitor their installations and consider immediate remediation steps. The novel method of using generative AI tools for reconnaissance raises concerns about future attacks in the software supply chain landscape.
Source link
