Securing AI Coding Agents: Lessons from the nx Package Attack by Dakota Kim

The Attack

Last week marked the first documented case of AI coding tools being exploited for automated reconnaissance and data theft. A malicious npm package successfully weaponized AI coding assistants against their users through a coordinated attack chain.

The attack demonstrates a critical security gap: AI agents with broad permissions can be manipulated by malicious code/instructions to perform actions against user interests.

You can check the link above for a more detailed breakdown of the attack chain.

Setting The Stage

AI coding tools like Claude Code, GitHub Copilot, and Amazon Q require extensive permissions to function effectively. They can:

  • Access and modify files across the filesystem

  • Execute shell commands

  • Interact with external services and APIs

  • Install packages and dependencies

These permissions enable productivity but also create attack vectors. The nx package attack exploited this permission model rather than any specific vulnerability in the AI tools themselves.

Breaking Down The Attack

The malicious npm package contained a postinstall script disguised as "telemetry.js" that executed the following sequence:

  1. Bypass Security: Instructed AI agents to use dangerous flags:

    • Claude: --dangerously-skip-permissions

    • Gemini CLI: --yolo

    • Amazon Q: --trust-all-tools

  2. Reconnaissance: Directed agents to search for:

    • SSH keys and certificates

    • Environment variables and .env files

    • Cryptocurrency wallet artifacts

    • API tokens (GitHub, npm, etc.)

  3. Exfiltration: Created a public GitHub repository and uploaded collected data as base64-encoded files.

  4. Persistence: Attempted to append shutdown commands to shell configuration files.

The attack succeeded because AI agents executed instructions from untrusted code with the same authority as user-initiated commands.

Key Considerations

Permission Architecture

AI agents require permissions to function, but each permission increases attack surface. The fundamental challenge: balancing functionality with security risk.

Configuration Hierarchy

Modern AI tools implement multi-level configuration systems. Claude Code, for example, uses:

  • Personal settings: ~/.claude/settings.json

  • Project settings: .claude/settings.json (version controlled)

  • Local overrides: .claude/settings.local.json (git-ignored)

  • Enterprise policies: System-level managed settings that override user configurations

Trust Boundaries

AI agents cannot distinguish between legitimate user instructions and malicious code-generated prompts. This creates a trust boundary problem where untrusted code can leverage agent permissions.

File Access Controls

To prevent access to sensitive files, tools like Claude Code support deny-list configurations:

{
  "permissions": {
    "deny": ["**/.env", "**/secrets/**", "**/*.pem"]
  }
}

Core Security Principles

While the following sections detail specific configurations, these fundamental principles apply across all AI-assisted development:

Code Review Discipline

  1. Understand what you ship: Review all code changes, whether human or AI-generated

  2. Verify dependencies: Audit new packages and their postinstall scripts

  3. Understand the landscape of your automation: Understand what your build pipelines and CI/CD processes execute

Permission Model Awareness

  1. Know your attack surface: Document what permissions each tool has

  2. Regular audits: Review and update permission configurations quarterly

  3. Segregate environments: Different permission sets for development vs. production work

Token and Credential Management

  1. Rotate regularly: Implement rotation schedules for all access tokens

  2. Scope appropriately: Use fine-grained tokens with minimal required permissions

  3. Monitor usage: Track where and how tokens are being accessed

  4. Secure storage: Never store tokens in code; use secure vaults or environment management tools

Better Security Practices for Agentic AI

1. Command Review

Always review AI-suggested commands before execution. Pay special attention to:

  • Commands requiring elevated/root privileges (sudo)

  • File system operations in sensitive directories

  • Network operations to external services (the attack was a cURL request to a webhook!)

  • Package installations from untrusted registries

2. Environment Isolation

Use isolation techniques when working with untrusted code:

  • Development containers: Isolate project dependencies and runtime

  • Virtual machines/Sandbox: Complete system isolation for high-risk operations

3. Tool Configuration

Claude Code specific settings:

  • Audit permissions: /permissions

  • Configure project restrictions: .claude/settings.json

Enterprise deployment paths:

  • macOS: /Library/Application Support/ClaudeCode/managed-settings.json

  • Linux/WSL: /etc/claude-code/managed-settings.json

  • Windows: C:\ProgramData\ClaudeCode\managed-settings.json

4. Principle of Least Privilege

  • Start with minimal permissions

  • Grant additional access only when required

  • Regularly audit and revoke unnecessary permissions

  • Use project-specific configurations to limit scope

“You can’t stop the waves, but you can learn how to surf!”

The AI agent attack surface will continue to evolve. Organizations that implement robust and evolving AI security practices will maintain competitive advantages through:

  • Safe(r) adoption of productivity-enhancing tools

  • Reduced risk of data breaches and IP theft

  • Compliance with emerging AI governance requirements

  • Building trust with security-conscious clients and partners

Conclusion

The nx package attack was a complex attack chain that was based on social engineering of AI agents rather than technical exploits. This highlights a fundamental principle: security responsibility remains with the human operator, regardless of tool sophistication!

AI coding agents offer substantial productivity benefits when used with appropriate security controls. The key is implementing defense-in-depth strategies that assume both human error and malicious actors.

Dakota Kim