Skip to content
CVE PROGRAM SOURCE RECORD9.6 Critical

CVE-2025-10894

Nx: nx/devkit: malicious versions of nx and plugins published to npm

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

Malicious code was inserted into the Nx (build system) package and several related plugins. The tampered package was published to the npm software registry, via a supply-chain attack. Affected versions contain code that scans the file system, collects credentials, and posts them to GitHub as a repo under user's accounts.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

nx

Default version status: unaffected

  • 20.12.0affected
  • 21.8.0affected
  • 21.7.0affected
  • 20.11.0affected
  • 21.6.0affected
  • 20.10.0affected
  • 20.9.0affected
  • 21.5.0affected

nx/devkit

Default version status: unaffected

  • 20.9.0affected
  • 21.5.0affected

nx/enterprise-cloud

Default version status: unaffected

  • 3.2.0affected

nx/eslint

Default version status: unaffected

  • 21.5.0affected

nx/js

Default version status: unaffected

  • 20.9.0affected
  • 21.5.0affected

nx/key

Default version status: unaffected

  • 3.2.0affected

nx/node

Default version status: unaffected

  • 20.9.0affected
  • 21.5.0affected

nx/workspace

Default version status: unaffected

  • 20.9.0affected
  • 21.5.0affected

Red Hat Multicluster Global Hub

Default version status: unaffected

Red Hat OpenShift Serverless

Default version status: unaffected

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2

Default version status: unaffected

Red Hat Red Hat Ansible Automation Platform 2

Default version status: unaffected

References