---
title: Hackers Use AI Tools Against Developers in Supply Chain Attack
description: Cybercriminals hijack Nx tool on npm, infecting AI assistants to steal sensitive data, marking the first AI-driven malware attack.
canonical_url: https://codekeeper.co/ticker/cybercriminals-hijack-nx-tool-infect-ai-assistants
---

[Cyberattacks](https://codekeeper.co/ticker/tag/cyberattacks)

# Hackers Use AI Tools Against Developers in Supply Chain Attack

Cybercriminals hijack Nx tool on npm, infecting AI assistants to steal sensitive data, marking the first AI-driven malware attack.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Aug 29, 2025

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcybercriminals-hijack-nx-tool-infect-ai-assistants%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcybercriminals-hijack-nx-tool-infect-ai-assistants%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcybercriminals-hijack-nx-tool-infect-ai-assistants%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcybercriminals-hijack-nx-tool-infect-ai-assistants%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcybercriminals-hijack-nx-tool-infect-ai-assistants%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcybercriminals-hijack-nx-tool-infect-ai-assistants%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

Cybercriminals hijacked the popular Nx development tool on npm, infecting eight versions with malware that exploited AI coding assistants like Claude, Gemini, and Amazon Q. The attack, which lasted just over five hours on August 26, forced these AI tools to scan infected systems for GitHub tokens, SSH keys, cryptocurrency wallets, and other sensitive data. The stolen information was automatically uploaded to public GitHub repositories under victims' own accounts using the naming pattern "s1ngularity-repository-" - eliminating the need for external servers. Thousands of developers were potentially exposed during the brief window. A second wave followed, with attackers using stolen credentials to expose and duplicate private organizational repositories. This marks the first known case of malware weaponizing AI development tools for data theft. **Source:** [Infosecurity Magazine](https://www.infosecurity-magazine.com/news/npm-package-hijacked-ai-malware/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcybercriminals-hijack-nx-tool-infect-ai-assistants%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcybercriminals-hijack-nx-tool-infect-ai-assistants%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcybercriminals-hijack-nx-tool-infect-ai-assistants%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcybercriminals-hijack-nx-tool-infect-ai-assistants%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcybercriminals-hijack-nx-tool-infect-ai-assistants%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcybercriminals-hijack-nx-tool-infect-ai-assistants%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Cyberattacks Phishing Links Are Hiding Inside Google's Own Trusted Domains Sep 9, 2026](https://codekeeper.co/ticker/attackers-exploit-google-services-for-phishing)

[Cyberattacks ASOS App Hijacked by Hackers to Send Extortion Message Oct 7, 2026](https://codekeeper.co/ticker/asos-cyberattack-xuanye-group-threat)

[Hackers Use Ghost CMS Flaw to Infect 700+ Websites With ClickFix Malware Aug 12, 2026](https://codekeeper.co/ticker/ghost-cms-vulnerability-exploited-by-hackers)

[CISA Flagged Six Microsoft Zero-Days as Actively Exploited Back in February — Check You've Patched Aug 11, 2026](https://codekeeper.co/ticker/cisa-adds-microsoft-zero-day-flaws-to-kev-catalog)