# s1ngularity: supply chain attack leaks secrets on GitHub: everything you need to know

Malicious Nx npm versions ran post-install malware harvesting wallets, tokens and SSH keys, exfiltrating to victim GitHub repos; leaked tokens then exposed 5500+ private repos.

- Payout: Real-world hack
- Severity: critical
- Program: Nx
- Credited: Wiz Research
- Disclosed: 2025-08-27
- Write-up quality: 7/10
- Original: https://www.wiz.io/blog/s1ngularity-supply-chain-attack
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-s1ngularity-supply-chain-attack
- Tags: domain:oss impact:data-leak impact:integrity kind:incident platform:threat-intel sev:critical tech:ci-cd tech:github-actions tech:nodejs technique:source-review vuln:command-injection vuln:secrets-leak

**Target:** npm package @nrwl/nx / nx build system and GitHub Actions workflow
**Root cause:** A flawed GitHub Actions workflow used pull_request_target with unsanitized PR titles, allowing command injection with a read/write GITHUB_TOKEN; attackers used it to publish malicious npm versions whose post-install telemetry.js harvested secrets.
**Steps:**
1. Submit PR with malicious title to Nx repo workflow using `pull_request_target` and unsanitized title interpolation -> command injection with write GITHUB_TOKEN
2. Publish malicious nx versions (20.9.0-21.8.0 etc.) with post-install script invoking `telemetry.js`
3. On Linux/macOS, script enumerates wallets, keystores, `.env`, SSH keys, `gh auth token`, `.npmrc` into `/tmp/inventory.txt`
4. Invoke AI CLIs with `--dangerously-skip-permissions`/`--yolo`/`--trust-all-tools` to read filesystem
5. Double/triple base64 encode data, POST to `api.github.com/user/repos` and `/repos/*/contents/results.b64` creating `s1ngularity-repository*`
6. Append `sudo shutdown -h 0` to `~/.bashrc`/`~/.zshrc` for lockout
**How found:** Wiz Threat Research and StepSecurity observed malicious npm versions and public s1ngularity-repository repos; traced root cause to the pull_request_target workflow with unsanitized PR title; Adnan Khan and Wiz spotted the second wave of repo renaming.
**Exploitation:** Attacker gained repo write via PR-title injection, published trojanized npm packages; installs executed post-install malware on dev machines and CI, exfiltrating credentials to public repos in victims' own accounts. Phase two reused leaked GitHub tokens to flip 5500+ private repos public and rename them s1ngularity-repository-#5letters#.
**Escalation:** Phase one harvested GitHub tokens; phase two reused them to mass-publish private repos, scaling from individual dev machines to 400+ orgs and 5500+ repos.
**Insight:** pull_request_target workflows that interpolate PR-controlled fields (titles, branch names) into run steps give attackers a write GITHUB_TOKEN; also, post-install scripts in build tooling are a high-value supply chain vector worth monitoring via outbound api.github.com calls.