Vulnerability · Published Sep 24, 2025 · Assigned by redhat
CVE-2025-10894Nx: nx/devkit: malicious versions of nx and plugins published to npm
Critical 9.6
In plain English
A critical-severity security flaw in nx. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS 3.1)9.6Critical
Exploit odds (30 days)0.6%top 53.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC
Official description
Malicious code was inserted into the Nx (build system) package and several related plugins. The tampered package was published to the npm software registry, via a supply-chain attack. Affected versions contain code that scans the file system, collects credentials, and posts them to GitHub as a repo under user's accounts.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @nx/devkit | no fix listed | GHSA-cxm3-wv7p-598c |
| npm | @nx/devkit | no fix listed | MAL-2025-41436 |
| npm | @nx/devkit | no fix listed | GHSA-cxm3-wv7p-598c |
| npm | @nx/enterprise-cloud | no fix listed | GHSA-cxm3-wv7p-598c |
| npm | @nx/enterprise-cloud | no fix listed | MAL-2025-41437 |
| npm | @nx/eslint | no fix listed | GHSA-cxm3-wv7p-598c |
| npm | @nx/eslint | no fix listed | MAL-2025-41438 |
| npm | @nx/js | no fix listed | GHSA-cxm3-wv7p-598c |
| npm | @nx/js | no fix listed | MAL-2025-41439 |
| npm | @nx/js | no fix listed | GHSA-cxm3-wv7p-598c |
| npm | @nx/key | no fix listed | GHSA-cxm3-wv7p-598c |
| npm | @nx/key | no fix listed | MAL-2025-41440 |
| npm | @nx/key | no fix listed | GHSA-cxm3-wv7p-598c |
| npm | @nx/node | no fix listed | GHSA-cxm3-wv7p-598c |
| npm | @nx/node | no fix listed | GHSA-cxm3-wv7p-598c |
| npm | @nx/node | no fix listed | MAL-2025-41441 |
| npm | @nx/workspace | no fix listed | GHSA-cxm3-wv7p-598c |
| npm | @nx/workspace | no fix listed | MAL-2025-41442 |
| npm | @nx/workspace | no fix listed | GHSA-cxm3-wv7p-598c |
| npm | nx | no fix listed | MAL-2025-41443 |
| npm | nx | no fix listed | GHSA-cxm3-wv7p-598c |
| npm | nx | no fix listed | GHSA-cxm3-wv7p-598c |
| npm | nx | no fix listed | GHSA-cxm3-wv7p-598c |
| npm | nx | no fix listed | GHSA-cxm3-wv7p-598c |
| npm | nx | no fix listed | GHSA-cxm3-wv7p-598c |
| npm | nx | no fix listed | GHSA-cxm3-wv7p-598c |
| npm | nx | no fix listed | GHSA-cxm3-wv7p-598c |
| npm | nx | no fix listed | GHSA-cxm3-wv7p-598c |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| nx | 20.12.021.8.021.7.020.11.021.6.020.10.020.9.021.5.0 | |
| nx/devkit | 20.9.021.5.0 | |
| nx/enterprise-cloud | 3.2.0 | |
| nx/eslint | 21.5.0 | |
| nx/js | 20.9.021.5.0 | |
| nx/key | 3.2.0 | |
| nx/node | 20.9.021.5.0 | |
| nx/workspace | 20.9.021.5.0 | |
| Red Hat | Multicluster Global Hub | see references |
| Red Hat | OpenShift Serverless | see references |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | see references |
| Red Hat | Red Hat Ansible Automation Platform 2 | see references |
Weakness: CWE-506 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
References
- https://access.redhat.com/security/cve/CVE-2025-10894 vdb-entry, x_refsource_REDHAT
- https://access.redhat.com/security/supply-chain-attacks-NPM-packages
- RHBZ#2396282 issue-tracking, x_refsource_REDHAT
- https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c
- https://www.stepsecurity.io/blog/supply-chain-security-alert-popular-nx-build-system-package-compromised-with-data-stealing-malware
- https://www.wiz.io/blog/s1ngularity-supply-chain-attack