detection.wiki

Detection rules › Panther

NX Supply Chain - S1ngularity Repository Detection

Tags
GitHub, Supply Chain Compromise, NX Package Compromise, Data Exfiltration
Source
github.com/panther-labs/panther-analysis

https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c Detects GitHub activity associated with the NX supply chain compromise (CVE-2024-XXXX). The s1ngularity attack compromised popular NX build system packages affecting ~4M weekly downloads. Attack Details: - Malicious NPM packages published August 26-27, 2025 (22:32-03:37 UTC) - Created repositories: "s1ngularity-repository", "s1ngularity-repository-0/1" for data exfiltration - Targeted cryptocurrency wallets, SSH keys, GitHub/NPM tokens, .env files - Used triple base64 encoding to upload stolen credentials - First documented case of weaponizing AI CLI tools for reconnaissance This query detects repository creation, access, and API activity patterns consistent with the attack.

Rules detecting the same action

Other rules on this platform that filter on the same API call or operation.

Rule body yaml

AnalysisType: saved_query
QueryName: NX Supply Chain - S1ngularity Repository Detection
Description: |
  https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c

  Detects GitHub activity associated with the NX supply chain compromise (CVE-2024-XXXX).
  The s1ngularity attack compromised popular NX build system packages affecting ~4M weekly downloads.
  
  Attack Details:
  - Malicious NPM packages published August 26-27, 2025 (22:32-03:37 UTC)
  - Created repositories: "s1ngularity-repository", "s1ngularity-repository-0/1" for data exfiltration
  - Targeted cryptocurrency wallets, SSH keys, GitHub/NPM tokens, .env files
  - Used triple base64 encoding to upload stolen credentials
  - First documented case of weaponizing AI CLI tools for reconnaissance
  
  This query detects repository creation, access, and API activity patterns consistent with the attack.
Tags:
  - GitHub
  - Supply Chain Compromise
  - NX Package Compromise
  - Data Exfiltration
Query: |
  SELECT 
    p_event_time,
    actor,
    action,
    repo,
    org,
    actor_ip,
    user_agent,
    visibility,
    public_repo,
    operation_type,
    created_at
  FROM panther_logs.public.github_audit
  WHERE p_event_time >= '2025-08-25 12:00:00'
    AND action IN ('repo.create', 'repo.access', 'repo.download_zip', 'team.add_repository')
    AND public_repo
    AND LOWER(COALESCE(repo, '')) LIKE '%s1ngularity-repository%'
  ORDER BY p_event_time DESC

Detection logic

Stage 1: source

panther_logs.public.github_audit

Stage 2: filter

p_event_time ge "2025-08-25 12:00:00"
action in ["repo.create", "repo.access", "repo.download_zip", "team.add_repository"]

This rule also runs imperative logic the parser cannot express as a filter; the conditions above are the structured part it could extract.

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
actionin
  • repo.access
  • repo.create
  • repo.download_zip
  • team.add_repository
p_event_timege
  • 2025-08-25 12:00:00

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

Field
p_event_time
actor
action
repo
org
actor_ip
user_agent
visibility
public_repo
operation_type
created_at