Unit 1: The shell and the filesystem · Lesson 5 of 5 · 24 min
Case file: what a home directory gives away
A poisoned build tool searched developer home folders for keys. Find everything it could take from one laptop.
mission
- You are
- You are the analyst reviewing riya's laptop after a bad package update.
- Situation
- On 14 October a malicious update of a build tool ran on riya's laptop and searched her home folder for credentials. A copy of that home folder is in /srv/cases/dev-laptop.
- Goal
- List every file an attacker would take, then decide what to rotate first.
- Hand in
- A rotation list: secret, where it lives, who issues it.
case file
Nx 's1ngularity' npm compromise abusing AI CLIs
Nx (Nrwl) · 2025
On August 26, 2025 malicious versions of the Nx build system were published to npm after a vulnerable GitHub Actions workflow exposed the publishing token. A post-install script on Linux and macOS ran locally installed AI command-line tools (Claude, Gemini and Q) with permission-bypass flags to search for wallets, keys and credentials, then uploaded results to public 's1ngularity-repository' repos in victims' GitHub accounts. Over 1,000 valid GitHub tokens leaked, and a second wave made thousands of private repos public.
What went wrong
A CI workflow injection flaw allowed token theft, and developer machines had powerful AI agents and plaintext secrets that the malware could direct.
What would have stopped it
- Harden CI workflows (avoid unsafe pull_request_target use, sanitize inputs) and use trusted publishing instead of long-lived npm tokens
- Disable or review npm install scripts and use a cooldown before adopting new package versions
- Never run AI CLIs with permission-bypass flags on machines holding secrets; store secrets in a vault
What defenders could have seen
- Shell history or EDR showing claude, gemini or q launched by node with bypass flags
- Files /tmp/inventory.txt and a 'sudo shutdown' line added to ~/.bashrc or ~/.zshrc
- New public GitHub repositories named s1ngularity-repository
sourceswiz.iostepsecurity.io
Read the case note
cat NOTE.txt
Copy of riya's laptop home directory, taken for review on 2026-10-15.
The machine ran a build tool update on 2026-10-14 that is now known to be malicious.
you should see A copy of the home folder, taken the day after the update ran.
Show the hidden entries
Credentials hide in dot folders. ls -A shows them without the . and .. noise.
ls -A
.aws
.bash_history
.config
.npmrc
.ssh
Documents
projects
you should see Five dot entries next to two normal folders.
Search for credential patterns
Search the whole tree for the shapes credentials take, not for file names you expect.
grep -rlE "_authToken|aws_secret|oauth_token|TOKEN=|SECRET_KEY|PRIVATE KEY" . | sort ./.aws/credentials ./.bash_history ./.config/gh/hosts.yml ./.npmrc ./.ssh/id_ed25519 ./projects/shop-web/.env grep -rlE "_authToken|aws_secret|oauth_token|TOKEN=|SECRET_KEY|PRIVATE KEY" . | wc -l 6
you should see Six files: package registry, cloud, GitHub, SSH, the shell history and a project .env.
defender tip Shell history is easy to forget. Tokens typed after export stay in .bash_history until someone clears it.
Check what the AI tool may do
The real malware asked AI command line tools on the laptop to do the searching. An assistant that may run any command and read any file will do that for anyone who can talk to it.
cat .config/ai-cli/settings.json
{
"model": "default",
"allow_all_commands": true,
"auto_approve_file_reads": true,
"workspace": "~"
}
you should see Every command allowed and file reads approved automatically, across the whole home folder.
Check SSH settings
grep -n ForwardAgent .ssh/config
2: ForwardAgent yes
you should see Agent forwarding for every host. Anyone with root on any server she connects to can use her keys while she is logged in.
Where a token should live
~/.npmrc //registry.npmjs.org/:_authToken=npm_... ~/.bash_history export GITHUB_TOKEN=ghp_...
Long-lived, in plain text, readable by any program she runs
npm login --auth-type=web gh auth login (system keychain) short-lived tokens, MFA to publish HISTCONTROL=ignorespace
Secrets in the keychain, short lifetimes, nothing in history
What a defender takes away
- 1Search by pattern, not by the file names you expect.
- 2Every secret found is rotated, not just deleted.
- 3Local AI tools get the least privilege that still does the job.
- 4Agent forwarding goes to named hosts only, or not at all.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.