PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

s1ngularity's Aftermath: AI, TTPs, and Impact in the Nx Supply Chain Attack

wiz.io | incident | #ai-security | #supply-chain | #github | #nx | #threat-research | #s1ngularity | #ai-malware
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Wiz's post-mortem of the s1ngularity Nx supply-chain attack: how AI-powered malware performed, impact quantified (1,700+ users' secrets leaked publicly) and novel TTPs for GitHub log review.
Published
Collected

Related coverage

incident · wiz.io
s1ngularity: supply chain attack leaks secrets on GitHub: everything you need to know
Wiz's initial analysis of s1ngularity: malicious Nx npm versions harvested wallets, tokens and SSH keys and abused local AI CLIs for recon; a second phase exposed 5,500+ private repositories.
blog · wiz.io
The emerging use of malware invoking AI
Wiz reviews malware that invokes AI directly — LameHug's HuggingFace recon prompts, the Amazon Q extension compromise, s1ngularity's AI-CLI abuse and PromptLock — moving prompts into payloads.
vulnerability · about.gitlab.com
Pillow CVE-2026-112900: How to find and fix it with GitLab
Upgrade to Pillow 13.0.0, then use dependency scanning, code search, and GitLab Duo Agent Platform to patch every affected Python project in your groups.
blog · jfrog.com
JFrog Names Nine Global Winners for Inaugural Software Supply Chain Excellence Awards
Discover the winners of the inaugural JFrog Software Supply Chain Excellence Awards, recognizing 9 global leaders managing and securing software for AI delivery at enterprise scale.
tool · github.com
Apple Private Cloud Compute (PCC) Security Source Code and Research Tools
Provides unprecedented source-level visibility into Apple's cloud AI infrastructure, allowing security researchers to verify cryptographic privacy guarantees and audit components eligible for Apple's PCC Security Bounty.
incident · wiz.io
Shai-Hulud 2.0 Supply Chain Attack: 25K+ Repos Exposing Secrets
Wiz Research's first Shai-Hulud 2.0 report: ~700 trojanized npm packages (Zapier, ENS, PostHog, Postman), 25,000+ repos leaking stolen secrets, and a preinstall variant widening the blast radius.
Back