Armando identified a malicious release of @nx/devkit, one of the most widely used packages in the Nx monorepo ecosystem, with over 621 million total downloads. Version 21.5.0, published on August 26, 2025, carries a postinstall credential stealer disguised as a telemetry script. What makes this attack stand out is its deliberate abuse of AI coding assistants -- the malware invokes Claude, Gemini, and Amazon Q CLI tools with permissive flags to use those agents as file-system crawlers, hunting for wallet files, SSH keys, and secrets on the developer's machine. The attack appears to be an account-level compromise of the Nx npm publisher, with no corresponding git tag found on the official nrwl/nx GitHub repository.
Key Findings
- Malicious version: v21.5.0, published 2025-08-26; v21.4.1 is clean
- Entry point:
postinstall lifecycle hook fires automatically on npm install
- Targets: Linux and macOS developer machines and CI/CD pipelines -- exits immediately on Windows
- Evasion: Deliberate Windows skip; timing delay before GitHub API exfiltration; disguises payload as
telemetry.js
- Detection: Script-JS.Infostealer.SupplyChain, Text.Infostealer.SupplyChain, Archive-GZIP.Infostealer.SupplyChain, Archive-TAR.Infostealer.SupplyChain
Package Background
@nx/devkit is the core developer toolkit package for Nx, a widely adopted build system and monorepo management platform. The package provides utility functions for file manipulation, configuration management, AST parsing, and generator scaffolding -- capabilities that make it a dependency of virtually every Nx workspace. It has been published since April 2023 and counts 1,250 direct dependents, with 621,585,197 total downloads recorded at the time of analysis.
The package is maintained by Nrwl (now Nx) through the GitHub repository at https://github.com/nrwl/nx. Its deep integration into developer toolchains -- spanning CI pipelines, build systems, and local workstations -- makes it an exceptionally high-value supply chain target.
Attack Analysis
The attack touches exactly one file relative to the clean v21.4.1 baseline: a single modified file. A script named was injected into the package root, and was updated to register it as the hook. The name is a deliberate social engineering choice -- it mimics legitimate telemetry collection scripts used by many development tools, reducing the chance a curious developer would look twice.