THREATPKG
SYNC STALE

Supply-chain threat intelligence

Incident detail

criticalnpm·maintainer compromise·osv

Malicious code in nx (npm)

nx

Risk score

92

AI summary

Indexed incident for nx (npm).

Description

-= Per source details. Do not edit below this line.=-

Source: google-open-source-security (94e241aa8202f641d66991ca134d9c18bf1fecbf8e89c2f2052aa2a7a41e5148)

The nx project and associated plugins were compromised via a vulnerable
GitHub workflow that allowed code injection and the theft of an NPM token.

Technical details

Affected versions

<function fixed() { [native code] }

Indicators

  • aliasCVE-2025-10894, GHSA-cxm3-wv7p-598c, MAL-2025-41436, MAL-2025-41437, MAL-2025-41438, MAL-2025-41439, MAL-2025-41441, MAL-2025-4144290%
  • affected_version<function fixed() { [native code] }75%
  • affected_version<function fixed() { [native code] }75%
  • affected_version<function fixed() { [native code] }75%
  • affected_version<function fixed() { [native code] }75%
  • affected_version<function fixed() { [native code] }75%
  • affected_version<function fixed() { [native code] }75%
  • affected_version<function fixed() { [native code] }75%
  • affected_version<function fixed() { [native code] }75%

Timeline

  1. Advisory published
  2. Indexed by ThreatPkg

Related incidents