Malicious Nx npm Packages Reportedly Weaponize AI Coding Agents for Data Exfiltration

Malicious versions of the popular Nx monorepo tool and plugins were reportedly published to npm after attackers compromised its CI workflow. The malware's postinstall script reportedly harvested credentials and exfiltrated data, reportedly weaponizing local AI coding agents such as Claude Code, Gemini, and Amazon q. By invoking unsafe flags, it allegedly coerced the tools into scanning developer machines for sensitive files, marking one of the first known AI-assisted supply chain attacks.

What this means for youAt home and at work, installing a software package can now quietly turn your AI coding helper against you to hunt for passwords and keys. Developers and small businesses should rotate exposed credentials, restrict what AI coding tools may access, and avoid running them with permissive flags. Governments and regulators are still working out supply chain security rules that cover AI tools.