Duplicate Advisory: Malicious versions of Nx were published

🗓️ 25 Sep 2025 00:30:27Reported by GitHub Advisory DatabaseType

Malicious Nx package versions published via supply-chain attack; they scan files, steal credentials, and post to GitHub.

Reporter	Title	Published	Views	Family All 70
Circl	CVE-2025-10894	25 Sep 202505:23	–	circl
CNNVD	Nx 安全漏洞	23 Sep 202500:00	–	cnnvd
CVE	CVE-2025-10894	24 Sep 202521:20	–	cve
Cvelist	CVE-2025-10894 Nx: nx/devkit: malicious versions of nx and plugins published to npm	24 Sep 202521:20	–	cvelist
EUVD	EUVD-2025-29473	3 Oct 202520:07	–	euvd
EUVD	EUVD-2025-31073	3 Oct 202520:07	–	euvd
EUVD	EUVD-2025-31134	3 Oct 202520:07	–	euvd
Github Security Blog	Malicious versions of Nx were published	27 Aug 202516:42	–	github
NVD	CVE-2025-10894	24 Sep 202522:15	–	nvd
OSV	CVE-2025-10894	24 Sep 202522:15	–	osv

Vulners

Node

Source	Link
github	www.github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-10894
access	www.access.redhat.com/security/cve/CVE-2025-10894
access	www.access.redhat.com/security/supply-chain-attacks-NPM-packages
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
stepsecurity	www.stepsecurity.io/blog/supply-chain-security-alert-popular-nx-build-system-package-compromised-with-data-stealing-malware
wiz	www.wiz.io/blog/s1ngularity-supply-chain-attack
github	www.github.com/advisories/GHSA-8mjq-32x3-22qf

25 Sep 2025 16:34Current

7.1High risk

Vulners AI Score7.1

CVSS 3.19.6

EPSS0.0031

SSVC