A credential-stealing campaign (August 2025) that compromised an Nx maintainer's npm account and shipped malicious versions of the nx build tool (nearly a billion downloads). A postinstall telemetry.js harvests cloud tokens and secrets and exfiltrates via attacker GitHub repositories; it shares methodology with the later Shai-Hulud worm.