CVE-2025-10894: Nx Build System Supply Chain Vulnerability

CVE-2025-10894 Overview

CVE-2025-10894 is a critical supply chain attack targeting the Nx build system package and several related plugins distributed through the npm software registry. Malicious code was injected into the package, enabling attackers to compromise developer systems by scanning file systems, harvesting credentials, and exfiltrating them to GitHub repositories under victim user accounts. This type of attack represents one of the most dangerous vectors in modern software development, as it leverages trusted package management infrastructure to distribute malware to unsuspecting developers and organizations.

Critical Impact
This supply chain compromise enables attackers to steal credentials and sensitive data from developer machines, potentially leading to further downstream attacks on production systems and proprietary source code repositories.

Affected Products

Nx build system npm package (compromised versions)
Nx-related npm plugins (multiple packages affected)
Developer systems that installed compromised package versions

Discovery Timeline

2025-09-24 - CVE CVE-2025-10894 published to NVD
2025-09-26 - Last updated in NVD database

Technical Details for CVE-2025-10894

Vulnerability Analysis

This vulnerability (CWE-506: Embedded Malicious Code) represents a sophisticated supply chain attack where threat actors successfully compromised the Nx build system package distribution chain. The malicious payload was designed to operate silently during normal package installation and build processes, making detection particularly challenging for development teams.

The attack leveraged the trusted npm ecosystem to distribute malware to developers who installed or updated the Nx package. Once executed, the malicious code performs reconnaissance of the local file system, specifically targeting credential stores, configuration files, and authentication tokens commonly found in development environments.

Root Cause

The root cause is the insertion of embedded malicious code (CWE-506) into the Nx package prior to its publication on the npm registry. This indicates either a compromise of the package maintainer's publishing credentials, a breach of the build/release pipeline, or a sophisticated social engineering attack that allowed unauthorized modifications to the package source before distribution.

Attack Vector

The attack is network-based and requires user interaction in the form of installing or updating the compromised package. Once the malicious package is installed, the embedded code executes automatically as part of the normal package installation or build process. The malicious payload performs the following operations:

File System Scanning: The code enumerates the local file system searching for sensitive files including SSH keys, AWS credentials, environment files, and other authentication tokens
Credential Harvesting: Discovered credentials and sensitive data are collected and prepared for exfiltration
Data Exfiltration: Harvested credentials are posted to GitHub repositories created under the victim's own GitHub account, leveraging existing Git credentials for authentication

This approach of using the victim's own GitHub account for exfiltration is particularly insidious, as it may evade network-based detection systems that whitelist GitHub traffic.

Detection Methods for CVE-2025-10894

Indicators of Compromise

Unexpected GitHub API calls or repository creation activity from build servers or developer workstations
Unauthorized file system access patterns targeting credential directories such as ~/.ssh, ~/.aws, and ~/.config
New or modified repositories in organizational GitHub accounts containing base64-encoded or obfuscated data
Unexpected network connections to GitHub during npm install or Nx build processes

Detection Strategies

Monitor npm package integrity using tools like npm audit and software composition analysis (SCA) solutions
Implement runtime monitoring on build servers to detect anomalous file system access and network activity
Review GitHub audit logs for unauthorized repository creation or unexpected API activity
Deploy endpoint detection and response (EDR) solutions capable of monitoring Node.js process behavior

Monitoring Recommendations

Enable comprehensive logging for npm install operations and build processes
Configure alerting for GitHub API activity originating from CI/CD systems and developer machines
Implement file integrity monitoring for sensitive credential directories
Utilize SentinelOne Singularity platform for real-time behavioral analysis of developer endpoints

How to Mitigate CVE-2025-10894

Immediate Actions Required

Audit all systems that may have installed the compromised Nx package versions and initiate incident response procedures
Rotate all credentials, API keys, SSH keys, and tokens that may have been exposed on affected systems
Review GitHub accounts associated with affected developers for unauthorized repositories or activity
Update to verified clean versions of the Nx package as indicated in the GitHub Security Advisory

Patch Information

Organizations should immediately verify their installed Nx package versions and update to patched releases. For detailed information on affected versions and remediation steps, consult the following resources:

Workarounds

Implement package pinning and lockfile verification to prevent automatic installation of compromised versions
Use npm's --ignore-scripts flag during installation to prevent automatic execution of package scripts while assessing risk
Deploy network segmentation to isolate build environments from sensitive credential stores
Consider using private npm registries with package verification and scanning capabilities

bash

# Verify package integrity and check for compromised versions
npm audit

# Lock package versions to prevent automatic updates
npm shrinkwrap

# Install with scripts disabled for investigation
npm install --ignore-scripts

# Check installed Nx version
npm list nx