CVE-2025-10894

CRITICAL9.6

Nx: nx/devkit: malicious versions of nx and plugins published to npm

Published Sep 24, 2025

Modified 3 months ago

Details

Malicious code was inserted into the Nx (build system) package and several related plugins. The tampered package was published to the npm software registry, via a supply-chain attack. Affected versions contain code that scans the file system, collects credentials, and posts them to GitHub as a repo under user's accounts.

References

WEB

https://access.redhat.com/security/cve/CVE-2025-10894

WEB

https://access.redhat.com/security/supply-chain-attacks-NPM-packages

WEB

https://bugzilla.redhat.com/show_bug.cgi?id=2396282

DETECTION

https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2025-10894

DETECTION