CVE-2025-10894
No fix known EPSS <1%CVSS 9.6
Malicious code was inserted into the Nx (build system) package and several related plugins. The tampered package was published to the npm software registry, via a supply-chain attack. Affected versions contain code that scans the file system, collects credentials, and posts them to GitHub as a repo under user's accounts.
Products: Red Hat Multicluster Global Hub, Red Hat OpenShift Serverless, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Ansible Automation Platform 2
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | @nx/devkit | no fix |
| npm | @nx/enterprise-cloud | no fix |
| npm | @nx/eslint | no fix |
| npm | @nx/js | no fix |
| npm | @nx/node | no fix |
| npm | @nx/workspace | no fix |
| npm | nx | no fix |