CVE-2025-10894

Sept. 25, 2025, 2:15 p.m.

9.6
Critical

Description

Malicious code was inserted into the Nx (build system) package and several related plugins. The tampered package was published to the npm software registry, via a supply-chain attack. Affected versions contain code that scans the file system, collects credentials, and posts them to GitHub as a repo under user's accounts.

Product(s) Impacted

Vendor Product Versions
Nx
  • Nx
  • *
Npm
  • Npm
  • *

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-506
Embedded Malicious Code
The product contains code that appears to be malicious in nature.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a nx nx / / / / / / / /
a npm npm / / / / / / / /

References

https://access.redhat.com/security/cve/CVE-2025-10894
https://access.redhat.com/security/supply-chain-attacks-NPM-packages
https://bugzilla.redhat.com/show_bug.cgi?id=2396282
https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c
https://www.stepsecurity.io/blog/supply-chain-security-alert-popular-nx-build-system-package-compromised-with-data-stealing-malware
https://www.wiz.io/blog/s1ngularity-supply-chain-attack
https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c
https://www.stepsecurity.io/blog/supply-chain-security-alert-popular-nx-build-system-package-compromised-with-data-stealing-malware

Tags

secalert@redhat.com
CWE-506
2025-09-24
CVE-2025-10894

CVSS Score

9.6 / 10

CVSS Data - 3.1

  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Privileges Required: NONE
  • Scope: CHANGED
  • Confidentiality Impact: HIGH
  • Integrity Impact: HIGH
  • Availability Impact: HIGH

    • CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

    View Vector String

Timeline

Published: Sept. 24, 2025, 10:15 p.m.
Last Modified: Sept. 25, 2025, 2:15 p.m.

Status : Received

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

secalert@redhat.com

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.