Supply Chain Security: The S1ngularity/nx Attack & How to Protect Your Studio

The S1ngularity/nx Attack: What Happened

In mid-September 2025, the npm ecosystem was hit by a new large-scale supply chain attack from a threat actor known as S1ngularity, building on tactics seen in the earlier Nx attack (August 27, 2025). What initially involved ~40 compromised packages escalated, and to date ~147 additional packages have been found infected, including ones tied to major vendors like CrowdStrike.

This attack marks a clear evolution: the malware now behaves like a worm, automatically propagating through compromised maintainers.

How the Worm Works

• Harvesting secrets: scans environment variables (process.env), uses TruffleHog, queries cloud metadata endpoints (AWS / GCP).
• Exfiltration (method 1): creates a GitHub repository called Shai-Hulud under compromised accounts, commits JSON dumps of system info, secrets, etc.
• Exfiltration (method 2): drops a GitHub Actions workflow (.github/workflows/shai-hulud-workflow.yml) that serializes all secrets (toJSON(secrets)), sends them to a webhook[.]site, and writes a double-base64 copy in the Actions logs.
• Propagation: uses any valid npm tokens found to re-publish the malicious payload in other npm packages the maintainer controls.
• Amplification: turns private repositories public, iterates across all repos the user has access to, adds workflows/branches to trigger further leaks.
• Technical infection mechanism:
  1. Downloads the target package’s tarball.
  2. Modifies package.json to bump the patch version and insert a postinstall lifecycle hook.
  3. Embeds its payload as bundle.js inside the tarball.
  4. Publishes the altered package using the maintainer’s credentials.

Packages Affected

Here’s the complete list of npm packages + versions confirmed compromised in the S1ngularity/nx campaign. If your project depends on any of these (at those versions), treat them as high-risk.

⚠️ Note: This list is what has been confirmed so far. There may be more compromised packages not yet detected. Always cross-check your dependencies proactively.

Immediate Steps for Development Teams

If your projects use npm packages, here’s what to do right now:

1. Clean your npm cache.
2. Reinstall all dependencies from scratch.
3. Ensure lock files (package-lock.json, yarn.lock, pnpm-lock.yaml) are committed to version control and used.
4. Pin exact dependency versions (avoid loose semver ranges) especially for any dependency from maintainers you don’t fully control.
5. Audit and revoke unnecessary npm tokens.

Building Long-Term Resilience

To protect against attacks like this going forward, studios should:

• Maintain a dependency inventory and schedule regular audits.
• Use automated scanning tools that can flag suspicious lifecycle hooks (e.g. postinstall), version bumps, and unexpected workflows.
• Monitor GitHub and other repo services for added workflows, new branches, or repositories made public unexpectedly.
• Limit scope of credentials/tokens, rotate them, and monitor usage.
• Use secure environments (e.g. containerized dev), enforce security gates in CI/CD, and possibly use tools that validate packages before they’re installed (e.g. verifying signatures or using threat-intel-backed wrappers).

Conclusion

The S1ngularity/nx incident demonstrates that supply chain threats have evolved: malicious actors are now building worms that spread automatically through abuse of package maintainers’ privileges.

For your studio, dependency security must be treated as core infrastructure, not an afterthought. Audit, lock, monitor, secure credentials — these are essential.