DarkReading.com reported that “More than 1,000 developers were infected with malware this week, losing around 20,000 sensitive files to the public Web, thanks to a devilishly effective, rapid, and AI-assisted software supply chain compromise.” The August 28, 2025 article entitled “1,000+ Devs Lose Their Secrets to an AI-Powered Stealer” (https://www.darkreading.com/cyberattacks-data-breaches/1000-devs-lose-secrets-ai-powered-stealer) included these comments:
Typically, when cyberattackers steal secret information from their victims, the process is deliberate and time-consuming. They spend a good deal of time studying their target’s systems, dropping multiple stages of malware, and making sure they’re not detected while they slowly download the data to their own servers.
From beginning to end, the attack that struck npm overnight on Aug. 26 took just over four hours. In only that brief window of time, unidentified attackers managed to undress more than 1,000 Javascript developers, stealing their GitHub tokens, npm tokens, SSH keys, application secrets, and cryptocurrency wallet files. They pulled that off by infecting a widely popular build system called “Nx” and by infusing their supply chain malware with artificial intelligence (AI)-powered intel-gathering capabilities.
Is anyone surprised?
First published at https://www.vogelitlaw.com/blog/immense-data-leak-from-sophisticated-supply-chain-attacks