CVE-2025-10894GHSA-CXM3-WV7P-598CMAL-2025-41436MAL-2025-41437MAL-2025-41438MAL-2025-41439MAL-2025-41441MAL-2025-41442MAL-2025-41443
Nx: nx/devkit: malicious versions of nx and plugins published to npm
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 proof of concept on GitHub
CISA's decision points: whether it is exploited, whether attacks can be automated, and how much control an attacker gets. Assessed (SSVC 2.0.3).What do these mean? →
- Exploitation: poc
- Automatable: no
- Technical impact: total
Summary
Malicious code was inserted into the Nx (build system) package and several related plugins. The tampered package was published to the npm software registry, via a supply-chain attack. Affected versions contain code that scans the file system, collects credentials, and posts them to GitHub as a repo under user's accounts.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: poc · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- nx
20.12.0, 21.8.0, 21.7.0, 20.11.0, 21.6.0, 20.10.0, 20.9.0, 21.5.0
- nx/devkit
20.9.0, 21.5.0
- nx/enterprise-cloud
3.2.0
- nx/eslint
21.5.0
- nx/js
20.9.0, 21.5.0
- nx/key
3.2.0
- nx/node
20.9.0, 21.5.0
- nx/workspace
20.9.0, 21.5.0
- multicluster-globalhub/multicluster-globalhub-grafana-rhel9
Version range not reported
- openshift-serverless-1/kn-backstage-plugins-eventmesh-rhel8
Version range not reported
- rhacm2/acm-grafana-rhel9
Version range not reported
- automation-gateway
Version range not reported