Malicious versions of Nx and some supporting plugins were published : blueteamsec@infosec.pub

Malicious versions of Nx and some supporting plugins were published (github.com)

submitted 1 year ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

comment fedilink hide all child comments

https://semgrep.dev/blog/2025/security-alert-nx-compromised-to-steal-wallets-and-credentials/

no comments (yet)

sorted by: hot top controversial new old

there doesn't seem to be anything here

2 comments in c/programming@programming.dev view that post

[–] Solemarc@lemmy.world 4 points 1 year ago* (1 child)

This doesn't look like a Claude issue or an AI issue, this looks like someone pushed malicious code to a repo and they where trying to make AI tools ignore these files? I'm not reading this wrong am I?

permalink

fedilink

source

hideshow 1 child comment

[–] qqq@lemmy.world [S] 5 points 1 year ago*

The command injection in the GitHub action code was written by Claude[1]. That was used to get the NPM key and then malware was pushed to NPM.

[1] https://github.com/nrwl/nx/pull/32458

permalink

fedilink

source

parent