CVE-2025-10894: Nx Build System Supply Chain Vulnerability

CVE-2025-10894 Overview

CVE-2025-10894 is a critical supply chain attack targeting the Nx build system package and several related plugins distributed through the npm software registry. Malicious code was injected into the package, enabling attackers to compromise developer systems by scanning file systems, harvesting credentials, and exfiltrating them to GitHub repositories under victim user accounts. This type of attack represents one of the most dangerous vectors in modern software development, as it leverages trusted package management infrastructure to distribute malware to unsuspecting developers and organizations.

Critical Impact

This supply chain compromise enables attackers to steal credentials and sensitive data from developer machines, potentially leading to further downstream attacks on production systems and proprietary source code repositories.

Affected Products

• Nx build system npm package (compromised versions)
• Nx-related npm plugins (multiple packages affected)
• Developer systems that installed compromised package versions

Discovery Timeline

• 2025-09-24 - CVE CVE-2025-10894 published to NVD
• 2025-09-26 - Last updated in NVD database

Technical Details for CVE-2025-10894

Vulnerability Analysis

This vulnerability (CWE-506: Embedded Malicious Code) represents a sophisticated supply chain attack where threat actors successfully compromised the Nx build system package distribution chain. The malicious payload was designed to operate silently during normal package installation and build processes, making detection particularly challenging for development teams.

The attack leveraged the trusted npm ecosystem to distribute malware to developers who installed or updated the Nx package. Once executed, the malicious code performs reconnaissance of the local file system, specifically targeting credential stores, configuration files, and authentication tokens commonly found in development environments.

Root Cause

The root cause is the insertion of embedded malicious code (CWE-506) into the Nx package prior to its publication on the npm registry. This indicates either a compromise of the package maintainer's publishing credentials, a breach of the build/release pipeline, or a sophisticated social engineering attack that allowed unauthorized modifications to the package source before distribution.

Attack Vector

The attack is network-based and requires user interaction in the form of installing or updating the compromised package. Once the malicious package is installed, the embedded code executes automatically as part of the normal package installation or build process. The malicious payload performs the following operations:

1. File System Scanning: The code enumerates the local file system searching for sensitive files including SSH keys, AWS credentials, environment files, and other authentication tokens
2. Credential Harvesting: Discovered credentials and sensitive data are collected and prepared for exfiltration
3. Data Exfiltration: Harvested credentials are posted to GitHub repositories created under the victim's own GitHub account, leveraging existing Git credentials for authentication

This approach of using the victim's own GitHub account for exfiltration is particularly insidious, as it may evade network-based detection systems that whitelist GitHub traffic.

Detection Methods for CVE-2025-10894

Indicators of Compromise

• Unexpected GitHub API calls or repository creation activity from build servers or developer workstations
• Unauthorized file system access patterns targeting credential directories such as ~/.ssh, ~/.aws, and ~/.config
• New or modified repositories in organizational GitHub accounts containing base64-encoded or obfuscated data
• Unexpected network connections to GitHub during npm install or Nx build processes

Detection Strategies

• Monitor npm package integrity using tools like npm audit and software composition analysis (SCA) solutions
• Implement runtime monitoring on build servers to detect anomalous file system access and network activity
• Review GitHub audit logs for unauthorized repository creation or unexpected API activity
• Deploy endpoint detection and response (EDR) solutions capable of monitoring Node.js process behavior

Monitoring Recommendations

• Enable comprehensive logging for npm install operations and build processes
• Configure alerting for GitHub API activity originating from CI/CD systems and developer machines
• Implement file integrity monitoring for sensitive credential directories
• Utilize SentinelOne Singularity platform for real-time behavioral analysis of developer endpoints

How to Mitigate CVE-2025-10894

Immediate Actions Required

• Audit all systems that may have installed the compromised Nx package versions and initiate incident response procedures
• Rotate all credentials, API keys, SSH keys, and tokens that may have been exposed on affected systems
• Review GitHub accounts associated with affected developers for unauthorized repositories or activity
• Update to verified clean versions of the Nx package as indicated in the GitHub Security Advisory

Patch Information

Organizations should immediately verify their installed Nx package versions and update to patched releases. For detailed information on affected versions and remediation steps, consult the following resources:

• GitHub Security Advisory GHSA-cxm3-wv7p-598c
• Red Hat CVE Summary
• Red Hat Supply Chain Advisory
• Step Security Blog Post
• Wiz Blog on Supply Chain Attack

Workarounds

• Implement package pinning and lockfile verification to prevent automatic installation of compromised versions
• Use npm's --ignore-scripts flag during installation to prevent automatic execution of package scripts while assessing risk
• Deploy network segmentation to isolate build environments from sensitive credential stores
• Consider using private npm registries with package verification and scanning capabilities

# Verify package integrity and check for compromised versions
npm audit

# Lock package versions to prevent automatic updates
npm shrinkwrap

# Install with scripts disabled for investigation
npm install --ignore-scripts

# Check installed Nx version
npm list nx