Full Report
A vulnerability has been discovered in Nx (build system) Package, which could allow for sensitive data exfiltration. Nx is a smart, fast, and extensible build system designed for managing monorepos efficiently by providing features like dependency graph analysis, computation caching, distributed task execution, and codebase upgrades. Successful exploitation of this vulnerability could allow an attacker to perform network reconnaissance and leak sensitive data.
Analysis Summary
# Vulnerability: Supply Chain Compromise in Nx Build System Leading to Data Exfiltration
## CVE Details
- CVE ID: CVE-2025-10894
- CVSS Score: Information Not Explicitly Provided (Implied HIGH due to severity and successful exploitation)
- CWE: T1195 (Supply Chain Compromise)
## Affected Systems
- Products: nx/devkit, nx/enterprise, nx/eslint, nx/js, nx/key, nx/node, nx/workspace
- Versions:
- nx/devkit: 21.5.0, 20.9.0
- nx/enterprise: 3.2.0
- nx/eslint: 21.5.0
- nx/js: 21.5.0, 20.9.0
- nx/key: 3.2.0
- nx/node: 21.5.0, 20.9.0
- nx/workspace: 21.5.0, 20.9.0
- Configurations: Targeted specifically at non-Windows systems during initial exploitation.
## Vulnerability Description
This vulnerability stems from a supply-chain attack where malicious code was injected into the Nx package and related plugins published to the npm registry. The compromised package contains a malicious post-install hook (`telemetry.js` with SHA-256 `99018A87285B1CC9864248AE505ABDDF9C5021EAA66EA10E9CD462B685EDBA81`) that executes immediately upon package installation. This script performs file system scanning to collect sensitive data (credentials, SSH keys, npm tokens, .gitconfig files) and weaponizes local AI assistant CLIs (Claude, Gemini, q) for reconnaissance and exfiltration. The malware then uploads this data, triple-base64 encoded in a file named `results.64`, to a newly created public GitHub repository (`s1ngularity-repository`) using stolen GitHub tokens. Persistence is achieved by causing any new terminal session to attempt an immediate system shutdown, creating a denial-of-service condition.
## Exploitation
- Status: Attackers have **successfully injected malicious code** and **stolen data** has been exfiltrated. (Implies exploitation in the wild)
- Complexity: Attack execution appears low post-installation due to the automated post-install hook mechanism.
- Attack Vector: Network (via package download), leading to Local execution.
## Impact
- Confidentiality: High (Collection and exfiltration of credentials, tokens, and sensitive configuration files, utilizing AI-assistant integration)
- Integrity: Medium (Malware attempts to cause disruption via system shutdown requests upon new terminal sessions)
- Availability: Medium (Malware imposes denial-of-service conditions by attempting immediate system shutdowns in new terminals)
## Remediation
### Patches
- Specific fixed versions are not listed in the source material, but the general recommendation is to **Apply appropriate updates provided by Nx or other vendors** to vulnerable systems immediately after testing.
### Workarounds
Immediate remediation steps recommended by StepSecurity:
1. **Secure organization repositories:** Make any exposed organization repositories private again.
2. **Isolate affected users:** Disconnect affected user(s) from the organization while mitigating this issue.
3. **Revoke all access tokens for affected users:** In affected user settings, revoke all installed apps, authorized apps, OAuth tokens (especially GitHub CLI tokens), SSH keys, and GPG keys.
4. **Remove forked repositories:** Delete any forked repositories from affected user accounts that may contain sensitive organizational data.
5. **Follow comprehensive remediation:** Complete all listed steps to ensure no credentials remain exposed.
## Detection
- Indicators of Compromise:
- Execution of `telemetry.js` post-installation.
- Outbound network connections to exfiltrate data (specifically interacting with GitHhub API after creating `s1ngularity-repository`).
- Attempted system shutdowns upon opening new terminal sessions.
- Detection Methods and Tools:
- Monitor package installation activities for unknown scripts running post-install.
- Conduct forensic analysis to check for the specific SHA-256 hash (`99018A87285B1CC9864248AE505ABDDF9C5021EAA66EA10E9CD462B685EDBA81`).
- Review user accounts for newly created public GitHub repositories named `s1ngularity-repository`.
## References
- CVE: hXXps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10894
- Vendor/Security Advisory: hXXps://www.stepsecurity.io/blog/supply-chain-security-alert-popular-nx-build-system-package-compromised-with-data-stealing-malware#check-if-youre-impacted