NXSweep

A security analysis tool that detects specific attack vectors used by malicious Node.js scripts targeting cryptocurrency wallets and development environments.

Overview

NXSweep scans your system for indicators that match the attack patterns of the NX malware family. It checks for:

• AI CLI Tools: Presence of claude, gemini, or q command-line interfaces
• GitHub Authentication: Valid GitHub tokens via gh CLI or environment variables
• NPM Configuration: Active npm user sessions and .npmrc files
• Shell Compromise: Malicious lines in ~/.bashrc or ~/.zshrc files
• Cryptocurrency Wallets: Files matching wallet-related patterns
• Attack Artifacts: /tmp/inventory.txt files created by the malware

Usage

Basic Scan

python3 NXSweep.py

Full Scan with AI CLI Testing

python3 NXSweep.py --cli

Custom Output File

python3 NXSweep.py --output=custom_report.json

Command Line Options

• --cli, -c: Execute AI CLI tools with test prompts (use with caution)
• --output=FILE, -o=FILE: Specify custom output file (default: NXSweepReport.json)

Output

Results are displayed in the terminal and saved to a JSON report file containing:

• Boolean indicators for each attack vector
• File paths of suspicious files found
• Authentication token presence (tokens are not exposed)
• Detailed scan results for forensic analysis

Security Notes

• This tool is for defensive security analysis only
• It mimics malware behavior to detect compromise indicators
• The --cli flag will execute AI tools with prompts - use only on isolated systems
• No sensitive data (tokens, keys) is exposed in output

Requirements

• Python 3.6+
• No external dependencies required
• Works on macOS, Linux, and Windows

License

This tool is provided for cybersecurity research and incident response purposes.