Documented incidentIncident 2025-08-26Nx (Nrwl)Engineering postmortem

GitHub Actions injection leaks Nx's npm token; malicious packages use local AI coding tools to hunt for secrets (2025)

A pull-request title validation workflow used pullrequesttarget, which runs with repository secrets, and echoed the unsanitized PR title, creating an injection point; the workflow's token also had read/write permissions.

What happened

  • A pull-request title validation workflow used pull_request_target, which runs with repository secrets, and echoed the unsanitized PR title, creating an injection point; the workflow's token also had read/write permissions.S1ngularity - What Happened, How We Responded, What We Learned
  • Attackers used it to run a malicious publish workflow, stole Nx's npm token and published malicious versions of several Nx packages for 4 hours on August 26, 2025.S1ngularity - What Happened, How We Responded, What We Learned
  • The packages' post-install script scanned users' machines for sensitive data, tried to use locally installed AI tools such as Claude and Gemini, and uploaded results to public GitHub repositories; Nx moved to npm Trusted Publishers with manual release approval.S1ngularity - What Happened, How We Responded, What We Learned

The failure pattern

Privileged action without an enforceable approval gateLimits and approvals live in a prompt, a UI checkbox or a convention instead of code the automation cannot bypass.How to prevent it Weak or phishable authentication on a privileged pathA password, an SMS code or a help-desk reset is all that stands between an attacker and admin access.How to prevent it AI action exceeds its intended scopeAn AI agent or assistant takes an action, or makes a promise, that nobody meant it to be able to make.How to prevent it
Watch the pattern: Privileged action without an enforceable approval gate

Safeguards that address it

CollectSEA's engineering analysis of what would have prevented or contained this failure.

  • Never run untrusted pull-request input with secretsAvoid pull_request_target for workflows that read PR content, treat titles and bodies as untrusted input, and give workflow tokens read-only permissions by default.
  • Require trusted publishing and human approval for releasesPublish packages through short-lived trusted-publisher credentials and a manual approval step rather than a long-lived token in CI.

Related standards

CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.

Building something similar?

Describe your design and see every precedent that applies, with safeguards you can hand to your coding agent.

Analyze your design

Incidents with the same pattern