Protect secrets from hijacked npm packages

Nx packages hijacked to hunt secrets with AI CLIs · Security incident · Hacker News · nrwl · Aug 2025

Malicious versions of the Nx build tool were published to npm; the install script used locally installed AI coding CLIs to search the machine for secrets and wallets and uploaded them to GitHub.

Lesson

Pin dependencies, use lockfiles and keep long-lived secrets off developer laptops.

Fix prompt

Copy this into your own AI tool (Cursor, Lovable, Claude Code, Bolt…). It's general guidance written by us. Review what the AI suggests before applying it.

Before I install anything my AI suggests in npm, help me check it's safe. For the package, extension or MCP server [name]: 1) Check it's the official one (publisher, repo link, download count, how recently it was updated, typo-squatted names). 2) List what permissions or access it gets (files, network, env vars, email). 3) Tell me how to pin the version and review install scripts. 4) Check my project for packages with known security advisories, and tell me how to update them. Don't install or remove anything until I confirm.

Source: Hacker News ↗