PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

s1ngularity: supply chain attack leaks secrets on GitHub: everything you need to know

wiz.io | incident | #ai-security | #supply-chain | #secrets | #github-actions | #npm | #nx | #wiz-research | #s1ngularity
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Wiz's initial analysis of s1ngularity: malicious Nx npm versions harvested wallets, tokens and SSH keys and abused local AI CLIs for recon; a second phase exposed 5,500+ private repositories.
Published
Collected

Related coverage

incident · wiz.io
Shai-Hulud 2.0 Supply Chain Attack: 25K+ Repos Exposing Secrets
Wiz Research's first Shai-Hulud 2.0 report: ~700 trojanized npm packages (Zapier, ENS, PostHog, Postman), 25,000+ repos leaking stolen secrets, and a preinstall variant widening the blast radius.
blog · wiz.io
Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware
Wiz details the Shai-Hulud npm worm — malicious releases harvested secrets with TruffleHog, dumped them to public GitHub repos and self-propagated via stolen npm tokens across 100+ packages.
incident · wiz.io
M-Red-Team: AsyncAPI Supply Chain Compromise via GitHub Actions
Four @asyncapi npm packages (5 versions) shipped after an attacker exploited a 'pwn request' in an asyncapi/generator GitHub Actions workflow to steal a bot token; the payload runs on import.
incident · wiz.io
Shai-Hulud 2.0 Aftermath: Trends, Victimology and Impact
Wiz Research's Shai-Hulud 2.0 aftermath: infection trends including a December 1 spike of 200+ new repos in 12 hours, victimology, leaked-secret distribution and the community containment response.
incident · wiz.io
Widespread npm Supply Chain Attack: Breaking Down Impact & Scope Across Debug, Chalk, and Beyond
Wiz dissects the npm debug/chalk incident: releases live ~2 hours carried a wallet-hijacking browser interceptor into affected builds; telemetry quantifies ~99% prevalence and ~10% malware presence.
incident · wiz.io
s1ngularity's Aftermath: AI, TTPs, and Impact in the Nx Supply Chain Attack
Wiz's post-mortem of the s1ngularity Nx supply-chain attack: how AI-powered malware performed, impact quantified (1,700+ users' secrets leaked publicly) and novel TTPs for GitHub log review.
Back