CVE-2025-10894: Nx build tools supply chain compromise via malicious npm versions

CVE-2025-10894 · Severity: info · CVSS 0 · Published 2025-08-27

Malicious versions of Nx (a popular JavaScript build and monorepo management tool) and several of its plugin packages were published to npm on August 27, 2025. The compromised packages contained malware that scanned the file system, harvested credentials and environment variables, and automatically posted them to GitHub repositories created under the developer's own account. Developers who installed these versions had their GitHub tokens, npm tokens, and other sensitive credentials exposed to the attacker.

Technologies: Nrwl Nx. Vendors: Nrwl.

Quick answers

Is CVE-2025-10894 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-10894 being exploited in the wild.
How severe is CVE-2025-10894?
Informational severity, with a CVSS score of 0, published 27 August 2025.
Which products and versions are affected?
Nrwl Nx 20.9.0, 20.10.0, 20.11.0, 20.12.0, 21.5.0, 21.6.0, 21.7.0, 21.8.0.
Is there a fix for CVE-2025-10894?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-10894 attacked?
It is attacked over the network.
Am I affected by CVE-2025-10894?
Check whether you run Nrwl Nx at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability stems from a bash injection flaw in a GitHub Actions workflow (using pull_request_target trigger) that lacked proper input sanitization on PR titles. An attacker injected malicious code that could execute with elevated permissions, leading to compromised GitHub secrets. The malware in the published npm packages performs filesystem scanning, credential collection from environment variables and shell profiles, and exfiltrates data by creating repositories named with "s1ngularity-repository" on the victim's GitHub account. The affected versions were removed from npm within hours of discovery (by 10:44 PM EDT on August 27, 2025). Developers must rotate all tokens and credentials immediately, verify GitHub audit logs for unauthorized repo creation, and remove any lingering malicious repositories.

Affected products

  • Nrwl Nx 20.9.0, 20.10.0, 20.11.0, 20.12.0, 21.5.0, 21.6.0, 21.7.0, 21.8.0
  • Nrwl @nx/devkit 20.9.0, 21.5.0
  • Nrwl @nx/js 20.9.0, 21.5.0
  • Nrwl @nx/workspace 20.9.0, 21.5.0
  • Nrwl @nx/node 20.9.0, 21.5.0
  • Nrwl @nx/eslint 21.5.0
  • Nrwl @nx/key 3.2.0
  • Nrwl @nx/enterprise-cloud 3.2.0

Identifiers

  • CVE-2025-10894
  • GHSA-cxm3-wv7p-598c

Timeline

  • 2025-08-27: disclosed: Malicious versions published to npm
  • 2025-08-27: other: Affected versions removed from npm
  • 2026-07-28: other: Advisory withdrawn

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.