CVE-2025-10894 Nx: nx/devkit: malicious versions of nx and plugins published to npm

Malicious code was inserted into the Nx build system package and several related plugins. The tampered package was published to the npm software registry, via a supply-chain attack. Affected versions contain code that scans the file system, collects credentials, and posts them to GitHub as a repo...

CVE-2025-10894

CVE-2025-10894 describes malicious versions of the Nx build system and related plugins published on the npm registry via a supply-chain attack. Affected packages contain code that scans the filesystem, collects credentials, and posts them to GitHub under the user’s account. The CVSSv3.1 base scor...

MAL-2025-41436 Malicious code in @nx/devkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8b11cb4be7497510402676b2b593e6a5d3e0dee4e1443996403e8aa496f284f3 Summary Malicious versions of the nx package, as well as some supporting plugin packages, were published to npm, containing code that scans the file...

Malicious code in @nx/devkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8b11cb4be7497510402676b2b593e6a5d3e0dee4e1443996403e8aa496f284f3 Summary Malicious versions of the nx package, as well as some supporting plugin packages, were published to npm, containing code that scans the file...

Embeded Malicious Code

Overview @nx/devkit is an AI-first build platform that connects everything from your editor to CI. Helping you deliver fast, without breaking things. This package contains a set of utilities for creating Nx plugins. Affected versions of this package are vulnerable to Embeded Malicious Code throug...

@abelfubu/schematics (>=0.0.3 <=0.1.1), @alfresco/aca-generators (>=1.0.2 <=1.0.4) +115 more potentially affected by CVE-2025-10894 via @nx/devkit (>=21.0.0-beta.0 <=21.5.0-canary.20250904-2c678a1)

@nx/devkit NPM version =21.0.0-beta.0, =0.0.3, =1.0.2, =1.0.0, =1.0.2, =0.0.11, =0.21.0, =0.0.1, =0.3.53, =0.0.5, =0.0.4, =9.0.2, =9.1.0 - @eumentis/nx-plugin =1.3.0 and more Source cves: CVE-2025-10894 Source advisory: SNYK:JS-NXDEVKIT-12205635...