{
 "id": "AIR-2025-0121",
 "slug": "malicious-nx-npm-packages-weaponize-ai-coding-agents-for-exf",
 "title": "Malicious Nx npm Packages Weaponize AI Coding Agents for Exfiltration",
 "summary": "Malicious npm packages compromised a CI pipeline and weaponized local AI coding agents to scan developer machines for sensitive files. The attack resulted in credential harvesting and data exfiltration.",
 "type": "ai_enabled_attack",
 "categories": [
  "supply_chain",
  "agent_hijack"
 ],
 "severity": 3,
 "targets": [
  "Anthropic",
  "Google",
  "Amazon",
  "framework_or_tooling"
 ],
 "products": [
  "Claude Code",
  "Gemini",
  "Amazon Q",
  "Nx"
 ],
 "incident_date": "2025-08-21",
 "incident_date_precision": "day",
 "first_reported": "2025-08-21",
 "sources": [
  {
   "url": "https://incidentdatabase.ai/cite/1210",
   "publisher": "AI Incident Database",
   "title": "Malicious Nx npm Packages Reportedly Weaponize AI Coding Agents for Data Exfiltration",
   "published_at": "2025-08-21"
  }
 ],
 "source_count": 1,
 "confidence": 0.9,
 "status": "published",
 "origin": "seed_aiid",
 "tags": [
  "supply_chain",
  "npm",
  "agent_hijack",
  "data_exfiltration"
 ],
 "created_at": "2026-10-18T06:33:31.967Z",
 "updated_at": "2026-10-18T06:59:35.797Z"
}