GHSA-8mjq-32x3-22qf: Duplicate Advisory: Malicious versions of Nx were published
This advisory was withdrawn on Sep 25, 2025. The publisher no longer considers it a valid vulnerability.
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-cxm3-wv7p-598c. This link is maintained to preserve external references. Original Description Malicious code was inserted into the Nx (build system) package and several related plugins. The tampered package was published to the npm software registry, via a supply-chain attack.
Published Sep 25, 2025
Affected packages
nx
- Ecosystem
- npm
- Affected
- = 21.5.0
- Fixed in
- No patched version yet
- Check
npm ls nx
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-cxm3-wv7p-598c. This link is maintained to preserve external references.
Original Description
Malicious code was inserted into the Nx (build system) package and several related plugins. The tampered package was published to the npm software registry, via a supply-chain attack. Affected versions contain code that scans the file system, collects credentials, and posts them to GitHub as a repo under user's accounts.
References
- https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c
- https://nvd.nist.gov/vuln/detail/CVE-2025-10894
- https://access.redhat.com/security/cve/CVE-2025-10894
- https://access.redhat.com/security/supply-chain-attacks-NPM-packages
- https://bugzilla.redhat.com/show_bug.cgi?id=2396282
- https://www.stepsecurity.io/blog/supply-chain-security-alert-popular-nx-build-system-package-compromised-with-data-stealing-malware
- https://www.wiz.io/blog/s1ngularity-supply-chain-attack
- https://github.com/advisories/GHSA-8mjq-32x3-22qf
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology