CVE-2025-10894

Published Sep 24, 2025

Last updated 3 months ago

CVSS critical 9.6
npm

Overview

Description
Malicious code was inserted into the Nx (build system) package and several related plugins. The tampered package was published to the npm software registry, via a supply-chain attack. Affected versions contain code that scans the file system, collects credentials, and posts them to GitHub as a repo under user's accounts.
Source
secalert@redhat.com
NVD status
Deferred

Risk scores

CVSS 3.1

Type
Secondary
Base score
9.6
Impact score
6
Exploitability score
2.8
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Severity
CRITICAL

Weaknesses

secalert@redhat.com
CWE-506

Social media

Hype score
Not currently trending

  1. 🚨 Critical - Nx Build System / Nx Console Supply Chain Attack (CVE-2025-10894) A massive software supply chain attack compromised the popular Nx build system and its corresponding Nx Console VS Code extension. Attackers extracted a maintainer’s npm publishing token via a

    @UpwindMDR

    18 May 2026

    418 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  2. 🚨 Critical - Nx Build System / Nx Console Supply Chain Attack (CVE-2025-10894) A massive software supply chain attack compromised the popular Nx build system and its corresponding Nx Console VS Code extension. Attackers extracted a maintainer’s npm publishing token via a

    @UpwindMDR

    18 May 2026

    2 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. 🚨 Critical - Nx Build System / Nx Console Supply Chain Attack (CVE-2025-10894 / "s1ngularity") A massive software supply chain attack compromised the popular Nx build system and its corresponding Nx Console VS Code extension. Attackers extracted a maintainer’s npm publishi

    @UpwindMDR

    18 May 2026

    1 Impression

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. Malicious versions of `Nx` have been published, posing a supply chain risk (CVE-2025-10894). Verify dependencies and scan for integrity. #Nx #SupplyChain #InfoSec https://t.co/mb4IQA4prG

    @pulsepatchio

    17 Mar 2026

    98 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  5. 🚨 CVE-2025-10894: CRITICAL supply-chain flaw in Nx build system (npm) enables credential theft via malicious code. Urgently audit & update affected versions! 🔒 https://t.co/ajvMSE9dB5 #OffSeq #SupplyChain #npm https://t.co/PIKGdBdHR7

    @offseq

    25 Sept 2025

    57 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  6. CVE-2025-10894 Malicious code was inserted into the Nx (build system) package and several related plugins. The tampered package was published to the npm software registry, via a sup… https://t.co/XnR31RbByd

    @CVEnew

    24 Sept 2025

    207 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  7. [CVE-2025-10894: CRITICAL] Malicious code discovered in Nx build system packages & plugins on npm registry, posing a cyber security threat. Code collects credentials & posts them to GitHub.#cve,CVE-2025-10894,#cybersecurity https://t.co/kdaNw2G6UC https://t.co/Fiob3UWQ14

    @CveFindCom

    24 Sept 2025

    64 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. Vitest is a testing framework powered by Vite. From 4.0.17 until 4.1.6 and 5.0.0-beta.3, Vitest Browser Mode served /__vitest_test__/ with the otelCarrier query parameter inserted directly into an inline module script, allowing a crafted browser-runner URL to execute arbitrary JavaScript in the Vitest server origin and recover VITEST_API_TOKEN for authenticated API calls. This issue is fixed in versions 4.1.6 and 5.0.0-beta.3.•CVE-2026-47428
  2. SimpleHelp Authentication Bypass Vulnerability•CVE-2026-48558
  3. BrowserStack Runner through 0.9.5 contains a path traversal vulnerability in the _default HTTP handler in lib/server.js that allows unauthenticated network-adjacent attackers to read arbitrary files. Attackers can exploit the unauthenticated HTTP server bound on all interfaces to traverse outside the project root and access sensitive files.•CVE-2026-49144
  4. Nx Console Embedded Malicious Code Vulnerability•CVE-2026-48027
  5. Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.•CVE-2026-9496

References

Sources include official advisories and independent security research.