MAL-2025-41442 Malicious code in @nx/workspace (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8b11cb4be7497510402676b2b593e6a5d3e0dee4e1443996403e8aa496f284f3 Summary Malicious versions of the nx package, as well as some supporting plugin packages, were published to npm, containing code that scans the file...

Malicious code in @nx/workspace (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8b11cb4be7497510402676b2b593e6a5d3e0dee4e1443996403e8aa496f284f3 Summary Malicious versions of the nx package, as well as some supporting plugin packages, were published to npm, containing code that scans the file...

@aws/nx-plugin (>=0.21.0 <=0.51.4), @caliobase/caliobase-nx (>=0.3.53 <=0.3.61) +49 more potentially affected by CVE-2025-10894 via @nx/workspace (>=21.0.0-beta.0 <=21.5.0-canary.20250904-2c678a1)

@nx/workspace NPM version =21.0.0-beta.0, =0.21.0, =0.3.53, =1.1.1, =2.1.1, =2.1.1, =2.1.1, =2.1.1, =0.0.1, =0.0.3, =0.0.1, =0.0.3, =0.0.3, =0.3.3 and more Source cves: CVE-2025-10894 Source advisory: SNYK:JS-NXWORKSPACE-12205641...

Embeded Malicious Code

Overview @nx/workspace is an AI-first build platform that connects everything from your editor to CI. Helping you deliver fast, without breaking things. Affected versions of this package are vulnerable to Embeded Malicious Code through a malicious postinstall script that triggers a file named...

@10xsai/cloudflare-router-nx-plugin (=1.0.0), @akanjs/test (>=0.0.47 <=0.0.73) +115 more potentially affected by CVE-2025-10894 via @nx/workspace (>=20.0.0-beta.0 <=20.9.0-canary.20250415-bc685ce)

@nx/workspace NPM version =20.0.0-beta.0, =0.0.47, =0.0.2, =0.0.0, =1.0.0, =1.0.0, =0.5.0, =1.8.2, =3.1.0, =0.0.1, =0.0.4 and more Source cves: CVE-2025-10894 Source advisory: SNYK:JS-NXWORKSPACE-12205641...