CVE-2025-10894

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2025
Source publication: Sep 24, 2025
Source updated: Nov 20, 2025
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

Nx: nx/devkit: malicious versions of nx and plugins published to npm

Malicious code was inserted into the Nx (build system) package and several related plugins. The tampered package was published to the npm software registry, via a supply-chain attack. Affected versions contain code that scans the file system, collects credentials, and posts them to GitHub as a repo under user's accounts.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

nx

Vendor: Unknown
Product: Unknown
Platforms: Unknown
Default status: unaffected
Package: nx
Package collection: https://github.com/nrwl/nx

nx · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
20.12.0	`affected`	Unavailable	Unavailable	Unavailable	None listed
21.8.0	`affected`	Unavailable	Unavailable	Unavailable	None listed
21.7.0	`affected`	Unavailable	Unavailable	Unavailable	None listed
20.11.0	`affected`	Unavailable	Unavailable	Unavailable	None listed
21.6.0	`affected`	Unavailable	Unavailable	Unavailable	None listed
20.10.0	`affected`	Unavailable	Unavailable	Unavailable	None listed
20.9.0	`affected`	Unavailable	Unavailable	Unavailable	None listed
21.5.0	`affected`	Unavailable	Unavailable	Unavailable	None listed

nx/devkit

Vendor: Unknown
Product: Unknown
Platforms: Unknown
Default status: unaffected
Package: nx/devkit
Package collection: https://github.com/nrwl/nx

nx/devkit · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
20.9.0	`affected`	Unavailable	Unavailable	Unavailable	None listed
21.5.0	`affected`	Unavailable	Unavailable	Unavailable	None listed

nx/enterprise-cloud

Vendor: Unknown
Product: Unknown
Platforms: Unknown
Default status: unaffected
Package: nx/enterprise-cloud
Package collection: https://nx.dev/powerpack

nx/enterprise-cloud · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
3.2.0	`affected`	Unavailable	Unavailable	Unavailable	None listed

nx/eslint

Vendor: Unknown
Product: Unknown
Platforms: Unknown
Default status: unaffected
Package: nx/eslint
Package collection: https://github.com/nrwl/nx

nx/eslint · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
21.5.0	`affected`	Unavailable	Unavailable	Unavailable	None listed

nx/js

Vendor: Unknown
Product: Unknown
Platforms: Unknown
Default status: unaffected
Package: nx/js
Package collection: https://github.com/nrwl/nx

nx/js · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
20.9.0	`affected`	Unavailable	Unavailable	Unavailable	None listed
21.5.0	`affected`	Unavailable	Unavailable	Unavailable	None listed

nx/key

Vendor: Unknown
Product: Unknown
Platforms: Unknown
Default status: unaffected
Package: nx/key
Package collection: https://github.com/nrwl/nx

nx/key · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
3.2.0	`affected`	Unavailable	Unavailable	Unavailable	None listed

nx/node

Vendor: Unknown
Product: Unknown
Platforms: Unknown
Default status: unaffected
Package: nx/node
Package collection: https://github.com/nrwl/nx

nx/node · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
20.9.0	`affected`	Unavailable	Unavailable	Unavailable	None listed
21.5.0	`affected`	Unavailable	Unavailable	Unavailable	None listed

nx/workspace

Vendor: Unknown
Product: Unknown
Platforms: Unknown
Default status: unaffected
Package: nx/workspace
Package collection: https://github.com/nrwl/nx

nx/workspace · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
20.9.0	`affected`	Unavailable	Unavailable	Unavailable	None listed
21.5.0	`affected`	Unavailable	Unavailable	Unavailable	None listed

Multicluster Global Hub

Vendor: Red Hat
Product: Multicluster Global Hub
Platforms: Unknown
Default status: unaffected
Package: multicluster-globalhub/multicluster-globalhub-grafana-rhel9
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

OpenShift Serverless

Vendor: Red Hat
Product: OpenShift Serverless
Platforms: Unknown
Default status: unaffected
Package: openshift-serverless-1/kn-backstage-plugins-eventmesh-rhel8
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat Advanced Cluster Management for Kubernetes 2

Vendor: Red Hat
Product: Red Hat Advanced Cluster Management for Kubernetes 2
Platforms: Unknown
Default status: unaffected
Package: rhacm2/acm-grafana-rhel9
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat Ansible Automation Platform 2

Vendor: Red Hat
Product: Red Hat Ansible Automation Platform 2
Platforms: Unknown
Default status: unaffected
Package: automation-gateway
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.