Nx (npm): stolen CI publish token used to release malicious nx and @nx/* packages that steal secrets via local AI CLIs (CVE-2025-10894)
Severity: critical · Patch status: patched · Since 2025-08-26 · CVE-2025-10894
On 2025-08-26 an attacker published malicious releases of the nx build tool and several @nx plugins, plus @nx/key and @nx/enterprise-cloud 3.2.0, to npm for roughly four hours using Nx's npm publish token. The token was lifted through a pullrequesttarget PR-validation workflow that echoed the PR title into a shell step; the attacker used the resulting repository token to alter and run the publish workflow, which exposed the npm token. A postinstall script (telemetry.js) on Linux and macOS searched for wallets, .env files, SSH keys, the gh token and .npmrc, drove any installed AI CLI tools to help find secrets, double or triple base64-encoded the loot into a public s1ngularity-repository repo in the victim's GitHub account, and appended a shutdown command to shell rc files. The Nx Console VS Code extension auto-installed the latest nx, so merely opening an editor could trigger it. Wiz counted 1,000+ valid GitHub tokens leaked; from 2025-08-28 the attacker used them to make 5,500+ private repositories of 400+ users and orgs public. npm removed the versions and revoked publish tokens, and Nx moved to 2FA and trusted publishing. This is separate from the 2026 Nx Console extension compromise (CVE-2026-48027).
What to do
- Search GitHub audit logs / your account for repos named s1ngularity-repository (also -0, -1) and for repos renamed s1ngularity-repository-XXXXX that were previously private
- Run npm ls nx and check lockfiles for nx 20.9.0-20.12.0 / 21.5.0-21.8.0 and @nx/* 21.5.0 / 20.9.0, @nx/key and @nx/enterprise-cloud 3.2.0; upgrade to any other version and clear package manager caches
- If any was installed, rotate GitHub, npm, cloud and SSH credentials and any secrets in .env or CI, from a clean machine
- Check ~/.bashrc and ~/.zshrc for an appended 'sudo shutdown -h 0' and look for /tmp/inventory.txt
- In your own repos, remove pull_request_target workflows that interpolate PR titles/branch names into shell steps, restrict GITHUB_TOKEN to read, and publish via npm trusted publishing with 2FA
Fixed versions
- Any version other than the listed ones (e.g. nx 21.5.1 published 2025-09-08)
Sources
All live incidents on Threat Watch
