AI CLI Supply Chain Lab: When Packages Use Your AI Tools
When a bad package version runs on a developer machine, the AI tools already installed there can become its search engine. Wiz says the Nx “s1ngularity” malware prompted Claude, Gemini and Q command-line tools to look for secrets, then uploaded what it found to public repositories, and that leaked tokens were later used to publish private ones. Make 11 scored calls on scoping, rotation order, repository exposure, AI tool access and install controls.
Related: the GitHub supply chain attack anatomy, GitHub CI secret hardening and the npm supply chain tracker.
You are Alex Moreno, platform security lead at Harborline Systems. Malicious versions of a popular build tool were published to npm. Their install script used AI command-line tools already installed on developer machines to hunt for secrets, and leaked tokens then exposed private repositories. Across 11 decisions you work out what ran where, order the token rotation, make repositories private again, remove the AI tool access and add lockfile and provenance controls. The story follows the Nx "s1ngularity" campaign as written up by Wiz and by Nx; the organisation and repositories are fictional. No code or commands appear. Each call is scored 0 to 10 with the source behind the rationale.
Make it yours
Replace the sample names so the scenario and the debrief you export are about your organisation.
TL;DRWhat this lab is
5 points
- A scenario lab with 11 scored decisions about malicious package versions whose install script used AI command-line tools already on developer machines to hunt for secrets, after which leaked tokens exposed private repositories.
- Based on the Nx "s1ngularity" campaign of 26 August 2025 as written up by Wiz and by Nx itself. Wiz says the malware ran on developer machines and in some build pipelines; Nx says the packages were live for about 4 hours.
- You decide what ran where, the token rotation order, how to make repositories private again, how to take ambient access away from AI tools, and which lockfile and provenance controls would have limited it.
- Free to play. Final score, debrief with the source behind each rationale, and links to the related labs.
- Defensive only. No code, commands or payload text appear. The organisation and repositories are fictional.
Claimed versus confirmed
Figures come only from Wiz and Nx and are attributed to them. Wiz and Nx are describing their own observations and response. We could not read the GitHub security advisory itself (GitHub blocked our automated fetch), so nothing is cited to it directly. Rotation order and the install-time control set are marked as PlayCISO practice.
Frequently asked questions
What happened in the Nx s1ngularity attack?
Nx says that on 26 August 2025 attackers used a GitHub Actions injection flaw to steal its npm publishing token and published malicious Nx package versions that were live for about 4 hours. Wiz says the install script searched for secrets, used installed AI command-line tools (including Claude, Gemini and Q) to help, and uploaded results to public repositories in victims' own GitHub accounts.
How many people were affected?
Wiz reports that in a second phase leaked GitHub tokens were used to make private repositories public, affecting over 400 users or organisations and over 5,500 repositories, and observed over a thousand valid GitHub tokens in the leaked data. These are Wiz's observations, not a count of all victims.
Did it affect Windows?
Wiz says the payload executed only on Linux and macOS. Developers on Windows were not the target of the main payload, but check the hosts you have rather than assume.
Which credentials should be rotated first?
Wiz says to revoke and regenerate all GitHub tokens, npm tokens, SSH keys, API keys and environment secrets that may have leaked. The ordering in the lab (GitHub first, then publish tokens, cloud and production, then SSH and the rest) is PlayCISO practice based on what Wiz saw attackers use next, not a vendor standard.
Does npm provenance stop this?
Not by itself. Nx says the malicious versions lacked provenance, but provenance does not block unsigned packages from being installed. You have to check it as a gate. Nx moved its own publishing to npm trusted publishing.
Why does the lab say to remove the AI tools' access?
Wiz says the malware prompted installed AI tools with flags that skip permission checks to read the filesystem, and that this succeeded in hundreds of cases. The lasting fix is to remove ambient access, not only to rely on provider guardrails.
Sources
Opened on 4 November 2026 unless a note says otherwise. Vendor product pages are not used as evidence.
- s1ngularity: supply chain attack leaks secrets on GitHub: everything you need to know — Wiz, 27 Aug 2025, updated 29 Aug 2025. Accessed 4 November 2026.
- S1ngularity: What Happened, How We Responded, What We Learned — Nx (Juri Strumpflohner), 5 Sep 2025. Accessed 4 November 2026.
- nrwl/nx security advisories (the incident GitHub Security Advisory and its timeline) — GitHub / Nx, accessed 4 Nov 2026. Accessed 4 November 2026.GitHub returned 403 to our automated fetch, so no fact on this site is cited to the advisory itself. The Nx post-mortem above links to it and summarises it; read the advisory directly for the full timeline.
- Trusted publishing for npm packages — npm Docs, accessed 4 Nov 2026. Accessed 4 November 2026.
- Generating provenance statements — npm Docs, accessed 4 Nov 2026. Accessed 4 November 2026.
- LLM03:2025 Supply Chain — OWASP Gen AI Security Project, 2025. Accessed 4 November 2026.
- LLM06:2025 Excessive Agency — OWASP Gen AI Security Project, 2025. Accessed 4 November 2026.
- SP 800-218, Secure Software Development Framework (SSDF) Version 1.1 — NIST, Feb 2022. Accessed 4 November 2026.Only the publication page was read. We cite the framework as a whole (protecting software and verifying release integrity), not individual task numbers.
- Securing the Software Supply Chain: Recommended Practices Guide for Customers — CISA, accessed 4 Nov 2026. Accessed 4 November 2026.CISA returned "Access Denied" to our automated fetch. We list it as further reading only and quote nothing from it.
Scenario people, organisations and hosts are fictional. More tools.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.