NX COMPROMISED TO STEAL WALLETS AND CREDENTIALS

Summary from the TLDR InfoSec newsletter

The popular NX build system was compromised with malicious versions published to npm that steal cryptocurrency wallets, API keys, and credentials from at least 1,400 affected users. The malware creates repositories prefixed with "s1ngularity-repository" in victims' GitHub accounts. It uniquely leverages the Claude Code CLI or Gemini CLI to execute file system searches for sensitive data through AI prompts, making detection more challenging for traditional security tools. Users should immediately check for unauthorized repositories, update to version 21.4.1, and rotate all potentially compromised credentials, including GitHub tokens, npm keys, and SSH keys.