Malicious packages attempted to use local AI tools to find secrets

1. Asked to do

   Not disclosed in the reviewed source.

2. Did

   Nx reports malicious npm packages that scanned machines and attempted to use installed AI tools for secret discovery. Non-AI scanning and upload functions were also present; agent contributions were not quantified.

3. Caught

   Not disclosed in the reviewed source.

4. Fixed

   Nx reports token revocation, release approvals and trusted publishing.

5. Still unknown

   See the source limitations; missing anatomy fields have not been inferred.

External systems affected or contacted: Affected developer machines and public upload repositories.. Origin: Real deployment.

Attempted agent-assisted human misuse. Malware propagation is not agent spread and multiple installed tools do not establish interacting agents.