AINewsnow

Malicious npm packages weaponized Claude, Gemini and Amazon Q CLIs to hunt secrets in the s1ngularity attack

On August 26, 2025, attackers compromised an npm publishing token for the Nx build system through a vulnerable GitHub Action and pushed malicious versions of nx and several @nx/* packages. The postinstall script didn't just grep the filesystem for secrets — it checked whether the host had a locally…

Read the full story at DEV Community — AI ↗

Timeline · 1 report

  1. 2026-11-01 11:17 · DEV Community — AI
    Malicious npm packages weaponized Claude, Gemini and Amazon Q CLIs to hunt secrets in the s1ngularity attack

More stories

  1. I gave Claude Code a crew. Codex and Gemini found a race in the plugin that runs them. — DEV Community — AI
  2. Your AI Agent Trusts Everything It Reads — A Field Guide to Hijacking Claude, GPT, Gemini & Copilot — DEV Community — AI
  3. DeepSeek Flash Pricing Swung Twice This Week, and GPT-6.1 Terra Just Showed Up — DEV Community — AI
  4. AI Needs Peer Review Too — DEV Community — AI
  5. Major AI chatbots ChatGPT, Claude, and Gemini suffer simultaneous outages — Mashable AI
  6. Gemini 4 Argon, 18 Days After GA: 50 on the Independent Index, 110M Tokens to Get There — DEV Community — AI
  7. I like Gemini's stupidity. — r/GeminiAI
  8. Gemini 4 Carbon: What Developers Should Know — DEV Community — AI

Get the daily brief of stories like this at 6:30 every morning →