Malicious Nx npm Packages Weaponize AI Coding Agents for Exfiltration

# Malicious Nx npm Packages Weaponize AI Coding Agents for Exfiltration

https://gcdradar.vercel.app/incidents/malicious-nx-npm-packages-weaponize-ai-coding-agents-for-exf · AIR-2025-0121 · closed 2025-09-04

- Lane: Breaches & attacks
- Severity: 3 (Confirmed exploitation)
- Fix status: No fix needed
- First reported: 2025-08-21
- AI role: AI-enabled attack
- Products: Claude Code, Gemini, Amazon Q, Nx

## Summary

Malicious npm packages compromised a CI pipeline and weaponized local AI coding agents to scan developer machines for sensitive files. The attack resulted in credential harvesting and data exfiltration.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2025-08-21: Malicious Nx npm Packages Reportedly Weaponize AI Coding Agents for Data Exfiltration (https://incidentdatabase.ai/cite/1210)

## Sources

- 2025-08-21 AI Incident Database: Malicious Nx npm Packages Reportedly Weaponize AI Coding Agents for Data Exfiltration https://incidentdatabase.ai/cite/1210

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.