Nx s1ngularity (August 2025): from a PR title to a npm token

According to the Nx security advisory, a GitHub Actions workflow with a shell injection flaw let an attacker run commands through a pull request title, exposing an npm token. Malicious nx versions were then published on 26 August 2025 and removed that night.

The chain in the advisory

1. On 21 August 2025 a workflow was added that contained a bash injection flaw. A pull request title containing command substitution could run shell commands.
2. The workflow used the pull_request_target trigger, which runs with elevated permissions on the target repository.
3. The advisory says the workflow was removed from the main branch, but outdated branches still contained it, so it could still be triggered.
4. On 24 August a malicious commit altered a publish workflow to send the npm token to an external webhook, and the token was exposed.
5. On 26 August the attacker published malicious versions using the stolen token. Nx removed them at 10:44 PM EDT, after reporting.

Notice step 3. Deleting a vulnerable file from the default branch did not remove the vulnerability.

What the malicious versions did

A post-install script scanned the filesystem for text files, collected paths and credentials, and posted them, encoded, to a new GitHub repository under the victim's account, with a name containing s1ngularity-repository. It also added a shutdown command to shell startup files, and wrote a listing to /tmp/inventory.txt.

The editor extension path

The advisory says Nx Console for VS Code, versions 18.6.30 through 18.65.1, installed the latest nx package to check its version. Opening an editor with that extension during the exposure window could therefore trigger the payload. Version 18.66.0 removed the check. The JetBrains extension was not affected.

The lesson is broader than Nx. A tool that quietly runs a package manager to check something has an install step you never saw.

What the maintainers changed

The advisory lists: requiring 2FA or automation for publishing, moving to npm trusted publishing and removing npm tokens from the pipeline, rotating tokens and repository secrets, rebasing outdated branches, requiring approval for workflows triggered by external contributors, and enabling code scanning.

What users were told to do

Check installed versions with npm ls nx, reinstall the latest version, clear caches, look for s1ngularity-repository in GitHub audit logs, check /tmp/inventory.txt, rotate npm and GitHub credentials and review shell startup files.

Review your own workflows

• Search for pull_request_target and check what runs under it.
• Never put untrusted text, such as a PR title, directly into a shell command. Pass it through an environment variable instead.
• Audit every branch, not only the default one.
• Keep publish tokens out of jobs that handle outside contributions.

Try it yourself

Click through it at your own pace, or open it full screen. Look at where a check can stop a risky change.

Quick check

Sources

• Nx, GitHub security advisory GHSA-cxm3-wv7p-598c.

Last reviewed: 19 October 2026.