Malware

s1ngularity

S1ngularity, also known as QUIETVAULT, was a 2025 npm software supply-chain compromise involving trojanized versions of Nx build-system packages. Attackers abused a GitHub Actions workflow weakness to obtain repository and npm publishing credentials, then published malicious package releases. The packages used install-time hooks to search developer workstations and build environments for GitHub and npm tokens, cloud credentials, SSH keys, API keys, cryptocurrency wallet data, and sensitive files. The malware also used locally available AI command-line agents for credential and file reconnaissance. Stolen GitHub credentials were used to create public repositories containing exfiltrated data, and the attackers deleted branches and workflow-run artifacts to hinder investigation. The campaign primarily endangered Node.js developers, CI/CD runners, and organizations using affected Nx packages, demonstrating how compromised package-publishing workflows can distribute credential-stealing malware to downstream development environments.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1078Valid AccountsEvidence2

Attackers used compromised tokens and GitHub credentials to replace CI scripts, trigger publishing workflows, create public repositories, and publish malicious updates through automated systems.

T1195Supply Chain CompromiseEvidence1

Adopting a “cooldown” policy on updates can be a simple but effective way to avoid downloading malicious code.

Persistence

2 techniques

T1078Valid AccountsEvidence2

Attackers used compromised tokens and GitHub credentials to replace CI scripts, trigger publishing workflows, create public repositories, and publish malicious updates through automated systems.

T1546.004Unix Shell Configuration ModificationEvidence1

"S1ngularity didn't quietly exfiltrate credentials — it injected a shutdown command into the shell profile, something that would visibly kill your machine the next time you opened a terminal."

Privilege Escalation

2 techniques

T1078Valid AccountsEvidence2

Attackers used compromised tokens and GitHub credentials to replace CI scripts, trigger publishing workflows, create public repositories, and publish malicious updates through automated systems.

T1546.004Unix Shell Configuration ModificationEvidence1

"S1ngularity didn't quietly exfiltrate credentials — it injected a shutdown command into the shell profile, something that would visibly kill your machine the next time you opened a terminal."

Stealth

2 techniques

T1070Indicator RemovalEvidence1

After replacing the legitimate CI script and triggering publication, S1ngularity "covered their tracks by deleting branches and workflow runs."

T1078Valid AccountsEvidence2

Attackers used compromised tokens and GitHub credentials to replace CI scripts, trigger publishing workflows, create public repositories, and publish malicious updates through automated systems.

Credential Access

2 techniques

T1528Steal Application Access TokenEvidence1

The S1ngularity script exfiltrated Nx's NPM token; Shai-Hulud and CanisterWorm searched victim machines for npm tokens to publish malicious versions of associated packages.

T1552.004Private KeysEvidence2

Post-install hooks scanned systems for "credentials, tokens, or SSH keys," while AI-agent prompts were intended to locate GitHub/NPM tokens, cloud credentials, and SSH keys.

Discovery

1 technique

T1518Software DiscoveryEvidence1

Malicious Nx package versions were "actively searching for installed AI CLI tools to run them with --dangerously-skip-permissions."

Exfiltration

1 technique

T1567.001Exfiltration to Code RepositoryEvidence1

S1ngularity used GitHub credentials found on victim machines to post stolen information to public repositories titled "s1ngularity-repository." Mini Shai-Hulud creates a public GitHub repository if HTTPS exfiltration is unavailable.

INDICATORS OF COMPROMISE

IOCs tracked for this family

4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

4 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha1●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

11 SOURCESView more in app

reversing labs blogNews

Sep 30, 2026

Researcher’s Notebook Restrospective: How Malicious Updates Poison Your Environment | RL Blog

A malicious npm-package supply-chain campaign that stole credentials, tokens, cloud credentials, and SSH keys. It abused victim GitHub accounts for public-repository-based exfiltration and queried locally available AI agents to locate sensitive files.

aikido dev blogNews

Aug 24, 2026

Shai-Hulud was the best thing to happen to supply chain security

Supply-chain payload deployed through compromised Nx packages. It searched developer endpoints for credentials, SSH keys, cryptocurrency wallets, and installed AI CLI tools, and visibly injected a shutdown command into shell profiles.

reversing labs blogNews

Jul 28, 2026

AI coding agents: A call to action on dependency cooldowns | RL Blog

Named malware or attack family associated with large-scale software supply-chain attacks involving malicious library versions.

semgrep blogNews

Jun 9, 2026

RIP npm Postinstall Scripts: npm v12 Kills Auto Script Execution by Default | Semgrep

A named npm supply-chain malware campaign using injected bundle.js and postinstall hooks to execute malicious code during package installation.

+7 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching4

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

s1ngularity