Detection rules › Panther

Panther rules: nx

Rule	Severity
NX Supply Chain - S1ngularity Repository Detection

NX Supply Chain - S1ngularity Repository Detection

Tags: GitHub, Supply Chain Compromise, NX Package Compromise, Data Exfiltration
Source: github.com/panther-labs/panther-analysis

https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c Detects GitHub activity associated with the NX supply chain compromise (CVE-2024-XXXX). The s1ngularity attack compromised popular NX build system packages affecting ~4M weekly downloads. Attack Details: - Malicious NPM packages published August 26-27, 2025 (22:32-03:37 UTC) - Created repositories: "s1ngularity-repository", "s1ngularity-repository-0/1" for data exfiltration - Targeted cryptocurrency wallets, SSH keys, GitHub/NPM tokens, .env files - Used triple base64 encoding to upload stolen credentials - First documented case of weaponizing AI CLI tools for reconnaissance This query detects repository creation, access, and API activity patterns consistent with the attack.

Telemetry coverage

Platform	Record / event type
GitHub	Audit log action `repo.access`: Repository visibility changed
GitHub	Audit log action `repo.create`: Repository created
GitHub	Audit log action `repo.download_zip`: Repository source code archive downloaded as ZIP
GitHub	Audit log action `team.add_repository`: Repository access granted to team

Rules detecting the same action

These rules filter on the same operation.

GitHub - Repository was created (Kusto)
GitHub High Number Of Non Public GitHub Repositories Downloaded (YARA-L)
GitHub Private Repository Turned Public (Elastic)
Github Public Repository Created (Panther)
GitHub Repo Created (Elastic)
GitHub Repository Created (Panther)
GitHub Repository Visibility Change (Panther)
GitHub Repository Visibility Changed To Public (YARA-L)

Rule specification

AnalysisType: saved_query
QueryName: NX Supply Chain - S1ngularity Repository Detection
Description: |
  https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c

  Detects GitHub activity associated with the NX supply chain compromise (CVE-2024-XXXX).
  The s1ngularity attack compromised popular NX build system packages affecting ~4M weekly downloads.
  
  Attack Details:
  - Malicious NPM packages published August 26-27, 2025 (22:32-03:37 UTC)
  - Created repositories: "s1ngularity-repository", "s1ngularity-repository-0/1" for data exfiltration
  - Targeted cryptocurrency wallets, SSH keys, GitHub/NPM tokens, .env files
  - Used triple base64 encoding to upload stolen credentials
  - First documented case of weaponizing AI CLI tools for reconnaissance
  
  This query detects repository creation, access, and API activity patterns consistent with the attack.
Tags:
  - GitHub
  - Supply Chain Compromise
  - NX Package Compromise
  - Data Exfiltration
SnowflakeQuery: |
  SELECT
    p_event_time,
    actor,
    action,
    repo,
    org,
    actor_ip,
    user_agent,
    visibility,
    public_repo,
    operation_type,
    created_at
  FROM panther_logs.public.github_audit
  WHERE p_event_time >= '2025-08-25 12:00:00'
    AND action IN ('repo.create', 'repo.access', 'repo.download_zip', 'team.add_repository')
    AND public_repo
    AND LOWER(COALESCE(repo, '')) LIKE '%s1ngularity-repository%'
  ORDER BY p_event_time DESC

DatabricksQuery: |
  SELECT
    p_event_time,
    actor,
    action,
    repo,
    org,
    actor_ip,
    user_agent,
    visibility,
    public_repo,
    operation_type,
    created_at
  FROM panther_logs.github_audit
  WHERE p_event_time >= '2025-08-25 12:00:00'
    AND action IN ('repo.create', 'repo.access', 'repo.download_zip', 'team.add_repository')
    AND public_repo
    AND LOWER(COALESCE(repo, '')) LIKE '%s1ngularity-repository%'
  ORDER BY p_event_time DESC

Stages and Predicates

Stage 1: `source`

Table: panther_logs.public.github_audit

Stage 2: `filter`

p_event_time is at least 2025-08-25 12:00:00
action is one of repo.create, repo.access, repo.download_zip, team.add_repository

This rule also runs imperative logic the parser cannot express as a filter. The conditions above are the structured part it could extract.

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`action`	in	`repo.access` `repo.create` `repo.download_zip` `team.add_repository`	`field:"action" kind:in`
`p_event_time`	ge	`2025-08-25 12:00:00`	`field:"p_event_time" kind:ge value:"2025-08-25 12:00:00"`

Output fields

Fields the rule emits when it matches, drawn from the rule's alert_context.

Field
`p_event_time`
`actor`
`action`
`repo`
`org`
`actor_ip`
`user_agent`
`visibility`
`public_repo`
`operation_type`
`created_at`