Malicious versions of Nx were published
Date: 2025-08
Affected: npm/@nx/workspace, npm/@nx/js, npm/@nx/devkit
Attack vector: malware
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2025-10894
CWE: CWE-506

## Summary Malicious versions of the [`nx` package](https://www.npmjs.com/package/nx), as well as some supporting plugin packages, were published to npm, containing code that scans the file system, collects credentials, and posts them to GitHub as a repo under user's accounts. ## Immediate Actions Required ### For all users, check if you were impacted 1. Check your account's audit logs (https://github.com/settings/security-log?q=action%3Arepo.create) to see if a repo containing s1ngularity-repository in the name was published to your Github account. If so your credentials were likely compromised. Unfortunately, Github may have proactively deleted the repo for you. To be safe, rotate any credentials such as Github, NPM, and anything that may have been in your environment variables. 2. Check your local machine to see if there is a file at `/tmp/inventory.txt`, this file will contain a list of files which the malware probably read from. If this file exists, you have been affected. 3. Check this https://github.com/[GithubSlug]?tab=repositories&q=s1ngularity-repository to see if you have a repo containing s1ngularity-repository remains on your Github account. If you do not have the repository available to you anymore, reach out to Github support and they can provide you the contents of the repository. 4. Download the file in the repo for your own records. 5. Then, remove the repo from GitHub. 6. E-mail security@nrwl.io and we will instruct you on how to decode the file so you


Mitigations:

Architectural layers (MAESTRO):