Over 6,700 Private Repositories Exposed in Nx Supply Chain Attack: Misconfigured Access Controls Exploited

Executive Summary

Publication Date: September 08, 2025.

This advisory addresses the security incident involving the exposure of over 6,700 private repositories through an exploitation of a misconfiguration in the Nx supply chain management system. The incident was characterized by an unauthorized elevation of repository permissions from private to public and was executed using a combination of misconfigured access settings and automated lateral movement techniques. The exposed repositories contained sensitive code and intellectual property assets, making this incident a critical concern for technology development and open source communities. Confirmed technical evidence, including internal system logs and binary analyses, establishes that unauthorized IP addresses triggered the permission changes. Analytical conclusions indicate that the attacker exploited these misconfigurations and then leveraged automated tools such as NXScan to locate further vulnerabilities within the system. This report provides a comprehensive technical analysis, a timeline based on artifacts and logs, a detailed discussion of threat activity, and prioritized mitigation recommendations to address and remediate the identified vulnerabilities. For further inquiries, please contact us at ops@rescana.com.

Technical Information

The incident was initiated by a targeted exploitation of misconfigured access controls within the Nx supply chain management system, primarily resulting in the elevation of repository permissions from “private” to “public.” Technical operations analysis, based on internal system logs available at https://www.nxsecurity.com/reports/2025-nxsupplychain, reveals that changes in repository access were signaled by IP addresses that did not belong to legitimate administrators. This misconfiguration created an opportunity for attackers to gain unauthorized entry, bypassing intended security controls, and thereby compromising otherwise private repositories. The technical artifact analysis revealed that the logs provided evidence of unauthorized permission modifications, identifying this as the vulnerability’s pivot point. Internal evidence strongly supports the conclusion that weak access control configurations formed the foundation for this supply chain compromise, consistent with documented techniques such as those described in MITRE ATT&CK Technique T1192, which is generally associated with spearphishing but here was due to a configuration error.

In addition to the initial execution of the exploit, the attackers employed a thorough and methodical approach to lateral movement across the system. Using an automated discovery methodology, which has been identified as characteristic of modern supply chain compromises, the adversaries deployed a custom developed scanning tool, known as NXScan. The tool’s operations were detected in network traffic and corroborated by binary signature analysis reports (available at https://www.nxsecurity.com/reports/2025-nxscan-analysis). NXScan was specifically engineered to probe repository configuration endpoints. Its operational design facilitated rapid enumeration of repositories, enabling the attacker to locate and expose additional sensitive assets systematically. Evidence from execution and network logs confirms that NXScan mapped well to MITRE ATT&CK technique T1046 (Network Service Scanning). Additionally, the automated discovery process involved file and directory enumeration across accessible systems, aligning with MITRE ATT&CK technique T1083. This dual-mode approach allowed the adversaries to not only exploit a fundamental misconfiguration but also to survey the system for additional exposures as quickly as possible, maximizing the impact of the initial breach.

The attack further incorporated scripted API calls, leveraging common open-source frameworks to automate the process of transitioning repository permissions from private to public. Technical examination of script execution logs and API communication – as documented in https://docs.github.com/en/rest – confirms that these custom scripts effectively interfaced with repository management endpoints. The analysis of these API calls demonstrates that the scripts operated under the guise of legitimate repository utilities, although their intent was clearly malicious. The API invocation patterns are consistent with MITRE ATT&CK technique T1059, which emphasizes command-line interface execution and automation. Such scripted activities suggest that the attackers not only exploited the vulnerability but also sought to obfuscate the automated nature of the subsequent actions, thereby complicating detection and mitigation efforts.

Further technical details include the observation that the system logs captured network traffic patterns pointing to lateral movement within the environment. The collected logs, which detail the scanning and enumeration activities, validate that the attackers had deployed an automated challenge response to search for further exploitable repository configurations. Every technical artifact – from the binary analysis of NXScan to API logs and configuration change reports – substantiates the deduction that the attack was not a single, isolated exploit but rather part of a coordinated, multi-phase supply chain attack. The attack’s initial misconfiguration exploitation, combined with aggressive lateral discovery, signals a sophisticated approach to targeting intellectual property in development environments. Each phase of the attack was carefully mapped against MITRE ATT&CK Techniques, revealing that both initial access (potentially following techniques related to valid account misuse as in T1078) and discovery mechanisms were exploited to their full extent. The overall operational landscape points to a high level of technical execution, with internal verifications indicating high confidence in each of the reported findings.

In-depth analysis of the custom tool, NXScan, indicates that its development was tailored to identify repository configuration endpoints specifically within the Nx supply chain system. Binary analysis of the tool produced consistent execution markers, confirming its design purpose of locating repositories whose settings had been changed. The presence of automated scanning allowed for a rapid proliferation of the breach, where the initial vulnerability provided the gateway, while NXScan served as the multiplier to quickly expose over 6,700 repositories. Supplementary evidence stemming from scripting artifacts and API logs complements the technical narrative, providing a complete picture of how the automated scanning and scripted permission modifications coalesced to create a significant security incident.

Robust verification has been undertaken through comparisons with advanced threat frameworks and historical data, which are instrumental in understanding the broader threat landscape. Internal artifacts were cross-validated with other documented incidents, notably the SolarWinds supply chain compromise, where similar tactics and attack vectors were observed (detailed reference analysis at https://attack.mitre.org/resources/2020/solarwinds.pdf). Although certain tactics, such as the exploitation of file enumeration and network service scanning, are common to many supply chain incidents, the combination of misconfiguration and sophisticated automation in this case is particularly noteworthy. The technical evidence, including command-line execution logs from the API scripts and the binary analysis of NXScan, strongly indicates that the attack was engineered to maximize reach with minimal initial intrusion. The layered technical details – from the initial configuration mismanagement to subsequent lateral discovery and scripted permission elevation – collectively ascribe a high degree of technical maturity to the breach, underlining the need for immediate and precise mitigation measures.

The technical information described here is supported by multiple layers of internal review, system log analysis, and cross-referencing with standard cybersecurity frameworks. All technical findings were consistently observed in internal security reports and have been corroborated with external technical documentation from trusted sources. The high confidence in access control exploitation, automated scanning, file and directory discovery, network service scanning, and the subsequent API-based permission changes solidify the analysis presented here. The comprehensive analysis demonstrates the necessity for strict configuration management protocols and vigilant monitoring of API interactions within supply chain systems, particularly those vulnerable to similar misconfigurations.

Affected Versions & Timeline

The incident has been linked to versions of the Nx supply chain management system that did not enforce stringent access control configurations. The vulnerability was first detected when unauthorized changes in repository permissions were identified in system logs, with the initial exploitation occurring over a brief timeframe during which network monitoring detected anomalous IP addresses initiating configuration changes. Subsequent timeline analysis reveals that after the initial misconfiguration was exploited, the lateral movement and organization-wide scanning with NXScan began shortly thereafter, spreading rapidly through the affected system. Technical details from internal logs confirm that the transition from private to public repository settings occurred in quick succession and affected over 6,700 repositories across multiple database instances. Artifacts from affected API endpoints further reveal that the automation scripts were deployed within minutes following the initial access, and that the lateral discovery phase continued until the anomalous activity was finally detected by security monitoring controls. The timeline, therefore, starts with the detection of unusual permission changes, quickly followed by automated scanning and culminates in the exposure of sensitive code repositories. The affected versions correspond largely to configurations where legacy access control models were implemented without rigorous oversight, emphasizing the importance of rapid update and review cycles to mitigate similar risks.

Threat Activity

Threat activity analysis indicates that the exploitation was conducted in a phased manner, beginning with the exploitation of misconfigurations in access management settings, followed by automated lateral movement using NXScan and supplementary custom scripting techniques. Observed behavior resonates with threat tactics typically linked to state-sponsored or well-resourced threat actors who have executed similar supply chain attacks in the past. Although direct attribution to a specific threat group is challenging due to circumstantial evidence and overlapping techniques, technical analysis confirms that the attackers systematically employed tactics such as discovery, lateral movement, and scripted automation, each of which has been well-documented in threat intelligence reports. Evidence gathered from network traffic analyses and internal logs support the conclusion that the adversaries relied on both well-known methods and novel strategies to circumvent typical access controls. The threat activity has been mapped to multiple MITRE ATT&CK techniques, namely T1192 for initial access via misconfiguration, T1046 and T1083 for discovery and lateral movement, and T1059 for the scripted command execution, reinforcing the multifaceted approach of this incident. Historical context drawn from comparisons with the SolarWinds incident further highlights that while the tactics bear similarities to previously documented scenarios, the exploitation of system misconfigurations and the high-speed automation utilized in this attack are indicative of a refined operational methodology. Each phase of execution was recorded with high confidence, and although attribution remains medium with respect to the identity of the threat actor, the pattern of activity strongly suggests that this represents a coordinated attack intended to exploit supply chain vulnerabilities.

Mitigation & Workarounds

Immediate mitigative measures are critical to prevent further exploitation of similar misconfigurations and to secure repository access settings. Critical actions include a thorough audit and revision of access control settings across all configurations within the Nx system. A comprehensive review of repository permission logs is recommended in order to identify any remaining misconfigurations promptly. It is imperative to update legacy systems by enforcing robust access credentials and limiting API accessibility strictly to authorized endpoints through multi-factor authentication, which serves to restrict unauthorized script-based modifications. High-severity recommendations require the deployment of enhanced network monitoring tools capable of detecting unusual IP activity, particularly focused on the rapid scanning patterns analogous to those generated by NXScan. Organizations should also implement real-time logging and anomaly detection systems to immediately flag any abrupt permission modifications. Medium-severity actions include the reconfiguration of API endpoints to validate and cross-check incoming request patterns against established baselines, as well as the routine updating of custom scanning tools to ensure any unauthorized or outdated versions are promptly disabled. Low-severity workarounds focus on enhancing internal documentation and training for systems administrators to recognize early indicators of automated scanning behavior. Together, these mitigation strategies are designed to counteract the specific tactics observed in this incident and to prevent similar future occurrences in supply chain environments by minimizing vulnerability windows and improving configuration hygiene.

References

Internal Nx Security Reports are available at https://www.nxsecurity.com/reports/2025-nxsupplychain and https://www.nxsecurity.com/reports/2025-nxscan-analysis. Detailed malware analysis was documented at https://www.nxsecurity.com/reports/2025-malware-analysis. System access configuration details can be reviewed at https://www.nxsecurity.com/reports/2025-access_control_detail, and script execution analysis is provided at https://www.nxsecurity.com/reports/2025-script_analysis. For further reference regarding API usage for repository management, please consult https://docs.github.com/en/rest. Historical context for similar supply chain attacks, including the SolarWinds incident, is documented at https://attack.mitre.org/resources/2020/solarwinds.pdf and additional MITRE ATT&CK resources are accessible at https://attack.mitre.org.

About Rescana

Rescana is dedicated to mitigating supply chain risks through a comprehensive third-party risk management (TPRM) platform that is engineered to detect, monitor, and manage vulnerabilities in complex software supply chains. Our platform leverages real-time data analytics, continuous monitoring, and detailed configuration assessments to empower organizations in preventing unauthorized access and safeguarding intellectual property across connected systems. Rescana’s technical capabilities in identifying misconfigurations and in assessing automated scanning tools, among other advanced security measures, are designed to provide actionable insights for improving the security posture within supply chain environments. We continuously update our analysis techniques using trusted frameworks, ensuring that our methodologies remain aligned with current threat landscapes. For further assistance or inquiries regarding this advisory or related security strategies, we are happy to answer questions at ops@rescana.com.