MalwarePublished 27 Aug 2025

NX Compromised to Check for Claude Code CLI and Explore Filesystem for Credentials

Source Reddit NetSec

Description

An interesting approach to malware by checking for Claude Code CLI and Gemini CLI in compromised \`nx\` package to explore local filesystem and steal credentials, api keys, wallets, etc.

Impact

For European organizations, the impact of this threat could be significant, especially for those heavily reliant on modern development workflows that incorporate the 'nx' package and related CLIs like Claude Code and Gemini. The theft of credentials and API keys can lead to unauthorized access to cloud services, internal systems, and third-party platforms, potentially resulting in data breaches, intellectual property theft, and financial losses. Additionally, the compromise of cryptocurrency wallets could have direct monetary consequences. The targeted nature of the malware means that organizations with advanced development environments or those adopting AI-assisted coding tools may be at higher risk. This threat also highlights the broader risk of supply chain attacks, which have been a growing concern in Europe due to the increasing digitization and integration of software development processes. The potential for lateral movement within networks and the exfiltration of sensitive data could undermine trust in software supply chains and disrupt critical business operations. Furthermore, regulatory frameworks such as the GDPR impose strict requirements on data protection and breach notification, meaning affected organizations could face legal and reputational repercussions if compromised.

Defensive guidance

European organizations should implement a multi-layered mitigation strategy focused on supply chain security and development environment hygiene. First, verify the integrity and provenance of all packages, especially those critical to build and deployment pipelines, by using cryptographic signatures and trusted package registries. Employ automated tools to monitor for unusual package updates or modifications. Second, restrict the installation of development tools and CLIs to vetted and approved versions, and maintain an inventory of installed software to detect unauthorized additions like Claude Code CLI or Gemini CLI. Third, implement strict access controls and credential management practices, including the use of hardware security modules (HSMs) or secure vaults for storing API keys and wallets, minimizing their exposure on local filesystems. Fourth, enhance endpoint detection and response (EDR) capabilities to identify suspicious filesystem exploration or data exfiltration activities, focusing on developer workstations and build servers. Fifth, conduct regular security awareness training for developers to recognize supply chain risks and encourage reporting of anomalies. Finally, establish incident response plans tailored to supply chain compromises, including rapid isolation and forensic analysis of affected systems.

References

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 27 Aug 2025, 14:33 UTC

Technical details

References

Community reviews

Related threats