CVE-2025-10894

Published Sep 24, 2025

Last updated a month ago

CVSS critical 9.6
npm

Overview

Description
Malicious code was inserted into the Nx (build system) package and several related plugins. The tampered package was published to the npm software registry, via a supply-chain attack. Affected versions contain code that scans the file system, collects credentials, and posts them to GitHub as a repo under user's accounts.
Source
secalert@redhat.com
NVD status
Deferred

Risk scores

CVSS 3.1

Type
Secondary
Base score
9.6
Impact score
6
Exploitability score
2.8
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Severity
CRITICAL

Weaknesses

secalert@redhat.com
CWE-506

Social media

Hype score
Not currently trending

  1. Malicious versions of `Nx` have been published, posing a supply chain risk (CVE-2025-10894). Verify dependencies and scan for integrity. #Nx #SupplyChain #InfoSec https://t.co/mb4IQA4prG

    @pulsepatchio

    17 Mar 2026

    98 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  2. 🚨 CVE-2025-10894: CRITICAL supply-chain flaw in Nx build system (npm) enables credential theft via malicious code. Urgently audit & update affected versions! 🔒 https://t.co/ajvMSE9dB5 #OffSeq #SupplyChain #npm https://t.co/PIKGdBdHR7

    @offseq

    25 Sept 2025

    57 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. CVE-2025-10894 Malicious code was inserted into the Nx (build system) package and several related plugins. The tampered package was published to the npm software registry, via a sup… https://t.co/XnR31RbByd

    @CVEnew

    24 Sept 2025

    207 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. [CVE-2025-10894: CRITICAL] Malicious code discovered in Nx build system packages & plugins on npm registry, posing a cyber security threat. Code collects credentials & posts them to GitHub.#cve,CVE-2025-10894,#cybersecurity https://t.co/kdaNw2G6UC https://t.co/Fiob3UWQ14

    @CveFindCom

    24 Sept 2025

    64 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. Aquasecurity Trivy Embedded Malicious Code Vulnerability•CVE-2026-33634
  2. The `basic-ftp` FTP client library for Node.js contains a path traversal vulnerability (CWE-22) in versions prior to 5.2.0 in the `downloadToDir()` method. A malicious FTP server can send directory listings with filenames containing path traversal sequences (`../`) that cause files to be written outside the intended download directory. Version 5.2.0 patches the issue.•CVE-2026-27699
  3. set-in provides the set value of nested associative structure given array of keys. A prototype pollution vulnerability exists in the the npm package set-in (>=2.0.1, < 2.0.5). Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using Array.prototype. This has been fixed in version 2.0.5.•CVE-2026-26021
  4. Compressing is a compressing and uncompressing lib for node. In version 2.0.0 and 1.10.3 and prior, Compressing extracts TAR archives while restoring symbolic links without validating their targets. By embedding symlinks that resolve outside the intended extraction directory, an attacker can cause subsequent file entries to be written to arbitrary locations on the host file system. Depending on the extractor’s handling of existing files, this behavior may allow overwriting sensitive files or creating new files in security-critical locations. This issue has been patched in versions 1.10.4 and 2.0.1.•CVE-2026-24884
  5. n8n contains a critical Remote Code Execution (RCE) vulnerability in its workflow Expression evaluation system. Expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime. An authenticated attacker could abuse this behavior to execute arbitrary code with the privileges of the n8n process. Successful exploitation may lead to full compromise of the affected instance, including unauthorized access to sensitive data, modification of workflows, and execution of system-level operations.•CVE-2026-1470

References

Sources include official advisories and independent security research.