InfoAttack2025-08-26
ATTACK: Malicious Nx Packages Steal Developer and Service Credentials
Attackers exploited a GitHub Actions injection weakness, stole an npm publishing token and released malicious Nx packages designed to search systems for credentials.
Teams building internal Supply Chain and AI applications should pin package versions, protect publishing tokens and monitor build environments for credential access.
More details are available in the Nx postmortem.
The Dataleo angle
Package publishing credentials are production assets and should be governed with short-lived access, segregation of duties and rapid revocation.