Nx NPM packages poisoned in AI-assisted supply chain attack

Nx is the latest target of a software supply chain attack in the NPM ecosystem, with multiple malicious versions being uploaded to the NPM registry on Tuesday evening. According to researchers at Wiz, those poisoned packages were laden with malware designed to siphon secrets from developers, such as GitHub and NPM tokens, SSH keys, and cryptocurrency wallet details. Nx's security advisory, posted to GitHub, which details the affected versions, states that successful credential harvesting then led to those credentials being posted to GitHub as new public-facing repos under the corresponding user accounts. With a self-proclaimed 24 million NPM downloads per month, a successful supply chain attack on Nx, an open source codebase management platform, could in theory capture the details of myriad developers. "Given the popularity of the Nx ecosystem, and the novelty of AI tool abuse, this incident highlights the evolving sophistication of supply chain attacks," said Ashish Kurmi, co-founder of StepSecurity, in a blog post. "Immediate remediation is critical for anyone who installed the compromised versions." Wiz said the repos containing the stolen secrets remained alive and freely available to download for around eight hours before GitHub intervened by identifying and disabling them all. As for how the attacker gained access to Nx's NPM account, Wiz said it currently believes that a token, which had publishing rights to the compromised packages, was compromised through unspecified...