Malicious Nx npm Package Supply-Chain Compromise

CVE-2025-10894 refers to a supply-chain compromise of the Nx build system and related @nx npm plugins in which malicious code was inserted into published packages on the npm registry. The attack chain began with compromise of the Nx GitHub Actions environment via a workflow using pull_request_target on forked pull requests; attackers reportedly injected bash payloads through pull request titles, obtained arbitrary command execution in CI, and stole npm publishing credentials. Using those credentials, they published tampered Nx package versions and related plugins. The malicious packages executed post-install payloads, including code in files such as telemetry.js or bundle.js, that scanned victim file systems for SSH keys, GitHub and npm tokens, cloud credentials, and cryptocurrency wallet data, then exfiltrated the collected material by creating GitHub repositories under the victim's account and uploading the data there. The malware also modified shell startup files and attempted persistence through malicious workflow injection into repositories. The campaign primarily targeted macOS and Linux systems.