CVE-2025-10894
Nx: nx/devkit: malicious versions of nx and plugins published to npm
CRITICAL 9.6
At a glance
- Source
- NVD
- EPSS
- EPSS 0.56 % · percentile 47 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Deferred
Description
Malicious code was inserted into the Nx (build system) package and several related plugins. The tampered package was published to the npm software registry, via a supply-chain attack. Affected versions contain code that scans the file system, collects credentials, and posts them to GitHub as a repo under user's accounts.
Weaknesses (CWE)
- CWE-506 — Embedded Malicious Code
References
- https://access.redhat.com/security/cve/CVE-2025-10894
- https://access.redhat.com/security/supply-chain-attacks-NPM-packages
- https://bugzilla.redhat.com/show_bug.cgi?id=2396282
- https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c
- https://www.stepsecurity.io/blog/supply-chain-security-alert-popular-nx-build-system-package-compromised-with-data-stealing-malware
- https://www.wiz.io/blog/s1ngularity-supply-chain-attack
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H | redhat |
| CVSS 3.1 | CRITICAL 9.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H | NVD · secalert@redhat.com (Secondary) |
Advisories
- GHSA-cxm3-wv7p-598c — Malicious versions of Nx were published
- MAL-2025-41436 — Malicious code in @nx/devkit (npm)
- MAL-2025-41437 — Malicious code in @nx/enterprise-cloud (npm)
- MAL-2025-41438 — Malicious code in @nx/eslint (npm)
- MAL-2025-41439 — Malicious code in @nx/js (npm)
- MAL-2025-41440 — Malicious code in @nx/key (npm)
- MAL-2025-41441 — Malicious code in @nx/node (npm)
- MAL-2025-41442 — Malicious code in @nx/workspace (npm)
- MAL-2025-41443 — Malicious code in nx (npm)
European references
- ENISA EUVD · EUVD-2025-29473
- GCVE · GCVE-0-2025-10894
Affected products
| Product | Versions |
|---|---|
| nx | affected 20.12.0 ; affected 21.8.0 ; affected 21.7.0 ; affected 20.11.0 ; affected 21.6.0 ; affected 20.10.0 |
| nx/devkit | affected 20.9.0 ; affected 21.5.0 |
| nx/enterprise-cloud | affected 3.2.0 |
| nx/eslint | affected 21.5.0 |
| nx/js | affected 20.9.0 ; affected 21.5.0 |
| nx/key | affected 3.2.0 |
| nx/node | affected 20.9.0 ; affected 21.5.0 |
| nx/workspace | affected 20.9.0 ; affected 21.5.0 |
| Red Hat · Multicluster Global Hub | |
| Red Hat · OpenShift Serverless | |
| Red Hat · Red Hat Advanced Cluster Management for Kubernetes 2 | |
| Red Hat · Red Hat Ansible Automation Platform 2 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |