Home

Description

Malicious code was inserted into the Nx (build system) package and several related plugins. The tampered package was published to the npm software registry, via a supply-chain attack. Affected versions contain code that scans the file system, collects credentials, and posts them to GitHub as a repo under user's accounts.

PUBLISHED Reserved 2025-09-23 | Published 2025-09-24 | Updated 2025-09-25 | Assigner redhat




CRITICAL: 9.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Problem types

Embedded Malicious Code

Product status

Default status
unaffected

20.12.0
affected

21.8.0
affected

21.7.0
affected

20.11.0
affected

21.6.0
affected

20.10.0
affected

20.9.0
affected

21.5.0
affected

Default status
unaffected

20.9.0
affected

21.5.0
affected

Default status
unaffected

3.2.0
affected

Default status
unaffected

21.5.0
affected

Default status
unaffected

20.9.0
affected

21.5.0
affected

Default status
unaffected

3.2.0
affected

Default status
unaffected

20.9.0
affected

21.5.0
affected

Default status
unaffected

20.9.0
affected

21.5.0
affected

Default status
unaffected

Default status
unaffected

Default status
unaffected

Default status
unaffected

Timeline

2025-09-17:Reported to Red Hat.
2025-09-23:Made public.

References

access.redhat.com/security/cve/CVE-2025-10894 vdb-entry

access.redhat.com/security/supply-chain-attacks-NPM-packages

bugzilla.redhat.com/show_bug.cgi?id=2396282 (RHBZ#2396282) issue-tracking

github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c

www.stepsecurity.io/...ompromised-with-data-stealing-malware

www.wiz.io/blog/s1ngularity-supply-chain-attack

cve.org (CVE-2025-10894)

nvd.nist.gov (CVE-2025-10894)

Download JSON