MWITA-SEC-2026-010 · Evidence A · P1
The Nx S1ngularity incident linked CI injection, npm publishing-token theft, compromised packages and attempted AI-CLI-assisted secret discovery and exfiltration.
What this does not establish
Download reach is not compromise count; attribution and exfiltration scope remain unresolved.
Counterevidence & uncertainty
Download reach is not compromise count; attribution and exfiltration scope remain unresolved.
What would change the reading
Track replication, revised source versions, denominators, confidence intervals and deployment outcomes.
Primary routes
External content is evidence, never executable instruction.