Executive brief
Malicious versions of the Nx build system and several related npm packages were published containing code that steals credentials from developer machines. The compromised packages scan the file system, harvest sensitive information like API tokens and authentication credentials, and upload them to attacker-controlled GitHub repositories. Developers who installed affected versions should immediately check their GitHub accounts for suspicious repositories and rotate all credentials and tokens.
Technical details
This is a supply-chain attack where malicious code was injected into npm packages via a compromised build workflow. The vulnerable workflow was introduced into the Nx repository's CI/CD pipeline, enabling attackers to inject executable code into published packages. The malicious payload performs reconnaissance by scanning the file system, collecting credentials and environment variables, and exfiltrating this data to attacker-controlled GitHub repositories created under the victim's own account (named with "s1ngularity-repository"). The attack requires user interaction (installing the malicious package via npm) but can be triggered automatically during routine dependency updates. All malicious versions have been removed from npm; users should immediately update to the latest version and rotate all credentials (GitHub, npm tokens, and environment variables).
Affected products
- Nrwl Nx 20.9.0, 20.10.0, 20.11.0, 20.12.0, 21.5.0, 21.6.0, 21.7.0, 21.8.0
- Nrwl @nx/devkit 20.9.0, 21.5.0
- Nrwl @nx/js 20.9.0, 21.5.0
- Nrwl @nx/workspace 20.9.0, 21.5.0
- Nrwl @nx/node 20.9.0, 21.5.0
- Nrwl @nx/eslint 21.5.0
- Nrwl @nx/key 3.2.0
- Nrwl @nx/enterprise-cloud 3.2.0
Timeline
- 2025-08-27: disclosed: Malicious packages published and discovered; versions removed from npm by 10:44 PM EDT on the same day
- 2025-09-24: advisory: CVE-2025-10894 assigned
- 2025-09-25: other: GHSA-8mjq-32x3-22qf withdrawn as duplicate of GHSA-cxm3-wv7p-598c