CVE-2025-10894

-= Per source details. Do not edit below this line.=-

Source: ghsa-malware (8b11cb4be7497510402676b2b593e6a5d3e0dee4e1443996403e8aa496f284f3)

Summary

Malicious versions of the nx package, as well as some supporting plugin packages, were published to npm, containing code that scans the file system, collects credentials, and posts them to GitHub as a repo under user's accounts.

Immediate Actions Required

For all users, check if you were impacted

1. Check your account's audit logs (https://github.com/settings/security-log?q=action%3Arepo.create) to see if a repo containing s1ngularity-repository in the name was published to your Github account. If so your credentials were likely compromised. Unfortunately, Github may have proactively deleted the repo for you. To be safe, rotate any credentials such as Github, NPM, and anything that may have been in your environment variables.
2. Check your local machine to see if there is a file at /tmp/inventory.txt, this file will contain a list of files which the malware probably read from. If this file exists, you have been affected.
3. Check this https://github.com/[GithubSlug]?tab=repositories&q=s1ngularity-repository to see if you have a repo containing s1ngularity-repository remains on your Github account. If you do not have the repository available to you anymore, reach out to Github support and they can provide you the contents of the repository.
4. Download the file in the repo for your own records.
5. Then, remove the repo from GitHub.
6. E-mail [email protected] and we will instruct you on how to decode the file so you are aware what information was leaked
7. Rotate your credentials and tokens on all of your accounts.

Rotate your Github token

In order to rotate your Github token, follow these steps:

1. Visit https://github.com/settings/connections/applications/178c6fc778ccc68e1d6a. This is the setting for the Github app used by the gh CLI to authenticate itself.
2. Revoke access to that app. This will invalidate the OLD token which may have been compromised.
3. The next time you run the gh CLI, you will reauth and a NEW token will be generated.

If you do not do this, your Github access token may be utilized to do malicious activity on your Github account.

Rotate all of your tokens but this is specific instruction for Github to make it as easy as possible.

For all users, stop using the malicious versions

# Check if the version of nx you are using was a malicious version
npm ls nx

# If using affected versions, update immediately:
npm uninstall nx && npm install nx@latest

# Clear caches for any package manager
yarn cache clean --all 
pnpm store prune --force 
npm cache clean --force

# Remove cache directories

# Windows
%LocalAppData%/npm-cache/_npx 

# Unix
~/.npm/_npx

# Outputs of
yarn cache dir
pnpm store path

For Users Who were compromised:

Refer to the section above to see if you were compromised. If so, do the following.

• Rotate npm tokens: Visit https://www.npmjs.com/ and rotate your tokens.
• Rotate Github Tokens: Visit https://www.github.com/ and rotate your tokens.
• Change Github Credentials: Change passwords for Github
• Change your passwords for any other services you use.
• Check your .zshrc and .bashrc files for any unfamiliar lines and remove them.

Purge Malicious Versions from Internal Registries

For maintainers of internal registries Immediately remove the compromised versions listed above from your internal package registries (e.g., JFrog Artifactory, Sonatype Nexus) or any other proxies to [npmjs.org](http://npmjs.org/). This will prevent further internal downloads of the malicious code.

Affected Versions of nx

• 21.5.0
  • Published at 6:32 PM
• 20.9.0
• 20.10.0
• 21.6.0
• 20.11.0
• 21.7.0
• 21.8.0
• 20.12.0
  • Published at 8:37 PM

These versions have since been removed from NPM as of 10:44 PM EDT

Affected…

-= Per source details. Do not edit below this line.=-

Source: ghsa-malware (8b11cb4be7497510402676b2b593e6a5d3e0dee4e1443996403e8aa496f284f3)

Summary

Malicious versions of the nx package, as well as some supporting plugin packages, were published to npm, containing code that scans the file system, collects credentials, and posts them to GitHub as a repo under user's accounts.

Immediate Actions Required

For all users, check if you were impacted

1. Check your account's audit logs (https://github.com/settings/security-log?q=action%3Arepo.create) to see if a repo containing s1ngularity-repository in the name was published to your Github account. If so your credentials were likely compromised. Unfortunately, Github may have proactively deleted the repo for you. To be safe, rotate any credentials such as Github, NPM, and anything that may have been in your environment variables.
2. Check your local machine to see if there is a file at /tmp/inventory.txt, this file will contain a list of files which the malware probably read from. If this file exists, you have been affected.
3. Check this https://github.com/[GithubSlug]?tab=repositories&q=s1ngularity-repository to see if you have a repo containing s1ngularity-repository remains on your Github account. If you do not have the repository available to you anymore, reach out to Github support and they can provide you the contents of the repository.
4. Download the file in the repo for your own records.
5. Then, remove the repo from GitHub.
6. E-mail [email protected] and we will instruct you on how to decode the file so you are aware what information was leaked
7. Rotate your credentials and tokens on all of your accounts.

Rotate your Github token

In order to rotate your Github token, follow these steps:

1. Visit https://github.com/settings/connections/applications/178c6fc778ccc68e1d6a. This is the setting for the Github app used by the gh CLI to authenticate itself.
2. Revoke access to that app. This will invalidate the OLD token which may have been compromised.
3. The next time you run the gh CLI, you will reauth and a NEW token will be generated.

If you do not do this, your Github access token may be utilized to do malicious activity on your Github account.

Rotate all of your tokens but this is specific instruction for Github to make it as easy as possible.

For all users, stop using the malicious versions

# Check if the version of nx you are using was a malicious version
npm ls nx

# If using affected versions, update immediately:
npm uninstall nx && npm install nx@latest

# Clear caches for any package manager
yarn cache clean --all 
pnpm store prune --force 
npm cache clean --force

# Remove cache directories

# Windows
%LocalAppData%/npm-cache/_npx 

# Unix
~/.npm/_npx

# Outputs of
yarn cache dir
pnpm store path

For Users Who were compromised:

Refer to the section above to see if you were compromised. If so, do the following.

• Rotate npm tokens: Visit https://www.npmjs.com/ and rotate your tokens.
• Rotate Github Tokens: Visit https://www.github.com/ and rotate your tokens.
• Change Github Credentials: Change passwords for Github
• Change your passwords for any other services you use.
• Check your .zshrc and .bashrc files for any unfamiliar lines and remove them.

Purge Malicious Versions from Internal Registries

For maintainers of internal registries Immediately remove the compromised versions listed above from your internal package registries (e.g., JFrog Artifactory, Sonatype Nexus) or any other proxies to [npmjs.org](http://npmjs.org/). This will prevent further internal downloads of the malicious code.

Affected Versions of nx

• 21.5.0
  • Published at 6:32 PM
• 20.9.0
• 20.10.0
• 21.6.0
• 20.11.0
• 21.7.0
• 21.8.0
• 20.12.0
  • Published at 8:37 PM

These versions have since been removed from NPM as of 10:44 PM EDT

Affected…

-= Per source details. Do not edit below this line.=-

Source: ghsa-malware (8b11cb4be7497510402676b2b593e6a5d3e0dee4e1443996403e8aa496f284f3)

Summary

Malicious versions of the nx package, as well as some supporting plugin packages, were published to npm, containing code that scans the file system, collects credentials, and posts them to GitHub as a repo under user's accounts.

Immediate Actions Required

For all users, check if you were impacted

1. Check your account's audit logs (https://github.com/settings/security-log?q=action%3Arepo.create) to see if a repo containing s1ngularity-repository in the name was published to your Github account. If so your credentials were likely compromised. Unfortunately, Github may have proactively deleted the repo for you. To be safe, rotate any credentials such as Github, NPM, and anything that may have been in your environment variables.
2. Check your local machine to see if there is a file at /tmp/inventory.txt, this file will contain a list of files which the malware probably read from. If this file exists, you have been affected.
3. Check this https://github.com/[GithubSlug]?tab=repositories&q=s1ngularity-repository to see if you have a repo containing s1ngularity-repository remains on your Github account. If you do not have the repository available to you anymore, reach out to Github support and they can provide you the contents of the repository.
4. Download the file in the repo for your own records.
5. Then, remove the repo from GitHub.
6. E-mail [email protected] and we will instruct you on how to decode the file so you are aware what information was leaked
7. Rotate your credentials and tokens on all of your accounts.

Rotate your Github token

In order to rotate your Github token, follow these steps:

1. Visit https://github.com/settings/connections/applications/178c6fc778ccc68e1d6a. This is the setting for the Github app used by the gh CLI to authenticate itself.
2. Revoke access to that app. This will invalidate the OLD token which may have been compromised.
3. The next time you run the gh CLI, you will reauth and a NEW token will be generated.

If you do not do this, your Github access token may be utilized to do malicious activity on your Github account.

Rotate all of your tokens but this is specific instruction for Github to make it as easy as possible.

For all users, stop using the malicious versions

# Check if the version of nx you are using was a malicious version
npm ls nx

# If using affected versions, update immediately:
npm uninstall nx && npm install nx@latest

# Clear caches for any package manager
yarn cache clean --all 
pnpm store prune --force 
npm cache clean --force

# Remove cache directories

# Windows
%LocalAppData%/npm-cache/_npx 

# Unix
~/.npm/_npx

# Outputs of
yarn cache dir
pnpm store path

For Users Who were compromised:

Refer to the section above to see if you were compromised. If so, do the following.

• Rotate npm tokens: Visit https://www.npmjs.com/ and rotate your tokens.
• Rotate Github Tokens: Visit https://www.github.com/ and rotate your tokens.
• Change Github Credentials: Change passwords for Github
• Change your passwords for any other services you use.
• Check your .zshrc and .bashrc files for any unfamiliar lines and remove them.

Purge Malicious Versions from Internal Registries

For maintainers of internal registries Immediately remove the compromised versions listed above from your internal package registries (e.g., JFrog Artifactory, Sonatype Nexus) or any other proxies to [npmjs.org](http://npmjs.org/). This will prevent further internal downloads of the malicious code.

Affected Versions of nx

• 21.5.0
  • Published at 6:32 PM
• 20.9.0
• 20.10.0
• 21.6.0
• 20.11.0
• 21.7.0
• 21.8.0
• 20.12.0
  • Published at 8:37 PM

These versions have since been removed from NPM as of 10:44 PM EDT

Affected…

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (4a77d672a4263588b96bbf3fbf8ddbd4e1e7b6ee0bccd619a447bf9e301883b3)

The package @nx/[email protected] is published under the @nx scope and ships a heavily obfuscated JavaScript file (native.js) using hex-mangled identifiers (_0x1bbf0b...) at the tarball root. The @nx scope was the target of a known supply-chain compromise in which malicious versions were published with obfuscated payloads that harvest credentials and developer secrets from the installer environment. A legitimate @nx package would not ship an obfuscated native.js with this fingerprint. The combination of (a) publication under a high-value compromised scope and (b) shipping an obfuscated JS payload as a top-level file matches the structural fingerprint of that compromise.

Source: ghsa-malware (8b11cb4be7497510402676b2b593e6a5d3e0dee4e1443996403e8aa496f284f3)

Summary

Malicious versions of the nx package, as well as some supporting plugin packages, were published to npm, containing code that scans the file system, collects credentials, and posts them to GitHub as a repo under user's accounts.

Immediate Actions Required

For all users, check if you were impacted

1. Check your account's audit logs (https://github.com/settings/security-log?q=action%3Arepo.create) to see if a repo containing s1ngularity-repository in the name was published to your Github account. If so your credentials were likely compromised. Unfortunately, Github may have proactively deleted the repo for you. To be safe, rotate any credentials such as Github, NPM, and anything that may have been in your environment variables.
2. Check your local machine to see if there is a file at /tmp/inventory.txt, this file will contain a list of files which the malware probably read from. If this file exists, you have been affected.
3. Check this https://github.com/[GithubSlug]?tab=repositories&q=s1ngularity-repository to see if you have a repo containing s1ngularity-repository remains on your Github account. If you do not have the repository available to you anymore, reach out to Github support and they can provide you the contents of the repository.
4. Download the file in the repo for your own records.
5. Then, remove the repo from GitHub.
6. E-mail [email protected] and we will instruct you on how to decode the file so you are aware what information was leaked
7. Rotate your credentials and tokens on all of your accounts.

Rotate your Github token

In order to rotate your Github token, follow these steps:

1. Visit https://github.com/settings/connections/applications/178c6fc778ccc68e1d6a. This is the setting for the Github app used by the gh CLI to authenticate itself.
2. Revoke access to that app. This will invalidate the OLD token which may have been compromised.
3. The next time you run the gh CLI, you will reauth and a NEW token will be generated.

If you do not do this, your Github access token may be utilized to do malicious activity on your Github account.

Rotate all of your tokens but this is specific instruction for Github to make it as easy as possible.

For all users, stop using the malicious versions

# Check if the version of nx you are using was a malicious version
npm ls nx

# If using affected versions, update immediately:
npm uninstall nx && npm install nx@latest

# Clear caches for any package manager
yarn cache clean --all 
pnpm store prune --force 
npm cache clean --force

# Remove cache directories

# Windows
%LocalAppData%/npm-cache/_npx 

# Unix
~/.npm/_npx

# Outputs of
yarn cache dir
pnpm store path

For Users Who were compromised:

Refer to the section above to see if you were compromised. If so, do the following.

• Rotate npm tokens: Visit https://www.npmjs.com/ and rotate your tokens.
• Rotate Github Tokens: Visit https://www.github.com/ and rotate your tokens.
• Change Github Credentials: Change…

-= Per source details. Do not edit below this line.=-

Source: ghsa-malware (8b11cb4be7497510402676b2b593e6a5d3e0dee4e1443996403e8aa496f284f3)

Summary

Malicious versions of the nx package, as well as some supporting plugin packages, were published to npm, containing code that scans the file system, collects credentials, and posts them to GitHub as a repo under user's accounts.

Immediate Actions Required

For all users, check if you were impacted

1. Check your account's audit logs (https://github.com/settings/security-log?q=action%3Arepo.create) to see if a repo containing s1ngularity-repository in the name was published to your Github account. If so your credentials were likely compromised. Unfortunately, Github may have proactively deleted the repo for you. To be safe, rotate any credentials such as Github, NPM, and anything that may have been in your environment variables.
2. Check your local machine to see if there is a file at /tmp/inventory.txt, this file will contain a list of files which the malware probably read from. If this file exists, you have been affected.
3. Check this https://github.com/[GithubSlug]?tab=repositories&q=s1ngularity-repository to see if you have a repo containing s1ngularity-repository remains on your Github account. If you do not have the repository available to you anymore, reach out to Github support and they can provide you the contents of the repository.
4. Download the file in the repo for your own records.
5. Then, remove the repo from GitHub.
6. E-mail [email protected] and we will instruct you on how to decode the file so you are aware what information was leaked
7. Rotate your credentials and tokens on all of your accounts.

Rotate your Github token

In order to rotate your Github token, follow these steps:

1. Visit https://github.com/settings/connections/applications/178c6fc778ccc68e1d6a. This is the setting for the Github app used by the gh CLI to authenticate itself.
2. Revoke access to that app. This will invalidate the OLD token which may have been compromised.
3. The next time you run the gh CLI, you will reauth and a NEW token will be generated.

If you do not do this, your Github access token may be utilized to do malicious activity on your Github account.

Rotate all of your tokens but this is specific instruction for Github to make it as easy as possible.

For all users, stop using the malicious versions

# Check if the version of nx you are using was a malicious version
npm ls nx

# If using affected versions, update immediately:
npm uninstall nx && npm install nx@latest

# Clear caches for any package manager
yarn cache clean --all 
pnpm store prune --force 
npm cache clean --force

# Remove cache directories

# Windows
%LocalAppData%/npm-cache/_npx 

# Unix
~/.npm/_npx

# Outputs of
yarn cache dir
pnpm store path

For Users Who were compromised:

Refer to the section above to see if you were compromised. If so, do the following.

• Rotate npm tokens: Visit https://www.npmjs.com/ and rotate your tokens.
• Rotate Github Tokens: Visit https://www.github.com/ and rotate your tokens.
• Change Github Credentials: Change passwords for Github
• Change your passwords for any other services you use.
• Check your .zshrc and .bashrc files for any unfamiliar lines and remove them.

Purge Malicious Versions from Internal Registries

For maintainers of internal registries Immediately remove the compromised versions listed above from your internal package registries (e.g., JFrog Artifactory, Sonatype Nexus) or any other proxies to [npmjs.org](http://npmjs.org/). This will prevent further internal downloads of the malicious code.

Affected Versions of nx

• 21.5.0
  • Published at 6:32 PM
• 20.9.0
• 20.10.0
• 21.6.0
• 20.11.0
• 21.7.0
• 21.8.0
• 20.12.0
  • Published at 8:37 PM

These versions have since been removed from NPM as of 10:44 PM EDT

Affected…

-= Per source details. Do not edit below this line.=-

Source: ghsa-malware (8b11cb4be7497510402676b2b593e6a5d3e0dee4e1443996403e8aa496f284f3)

Summary

Malicious versions of the nx package, as well as some supporting plugin packages, were published to npm, containing code that scans the file system, collects credentials, and posts them to GitHub as a repo under user's accounts.

Immediate Actions Required

For all users, check if you were impacted

1. Check your account's audit logs (https://github.com/settings/security-log?q=action%3Arepo.create) to see if a repo containing s1ngularity-repository in the name was published to your Github account. If so your credentials were likely compromised. Unfortunately, Github may have proactively deleted the repo for you. To be safe, rotate any credentials such as Github, NPM, and anything that may have been in your environment variables.
2. Check your local machine to see if there is a file at /tmp/inventory.txt, this file will contain a list of files which the malware probably read from. If this file exists, you have been affected.
3. Check this https://github.com/[GithubSlug]?tab=repositories&q=s1ngularity-repository to see if you have a repo containing s1ngularity-repository remains on your Github account. If you do not have the repository available to you anymore, reach out to Github support and they can provide you the contents of the repository.
4. Download the file in the repo for your own records.
5. Then, remove the repo from GitHub.
6. E-mail [email protected] and we will instruct you on how to decode the file so you are aware what information was leaked
7. Rotate your credentials and tokens on all of your accounts.

Rotate your Github token

In order to rotate your Github token, follow these steps:

1. Visit https://github.com/settings/connections/applications/178c6fc778ccc68e1d6a. This is the setting for the Github app used by the gh CLI to authenticate itself.
2. Revoke access to that app. This will invalidate the OLD token which may have been compromised.
3. The next time you run the gh CLI, you will reauth and a NEW token will be generated.

If you do not do this, your Github access token may be utilized to do malicious activity on your Github account.

Rotate all of your tokens but this is specific instruction for Github to make it as easy as possible.

For all users, stop using the malicious versions

# Check if the version of nx you are using was a malicious version
npm ls nx

# If using affected versions, update immediately:
npm uninstall nx && npm install nx@latest

# Clear caches for any package manager
yarn cache clean --all 
pnpm store prune --force 
npm cache clean --force

# Remove cache directories

# Windows
%LocalAppData%/npm-cache/_npx 

# Unix
~/.npm/_npx

# Outputs of
yarn cache dir
pnpm store path

For Users Who were compromised:

Refer to the section above to see if you were compromised. If so, do the following.

• Rotate npm tokens: Visit https://www.npmjs.com/ and rotate your tokens.
• Rotate Github Tokens: Visit https://www.github.com/ and rotate your tokens.
• Change Github Credentials: Change passwords for Github
• Change your passwords for any other services you use.
• Check your .zshrc and .bashrc files for any unfamiliar lines and remove them.

Purge Malicious Versions from Internal Registries

For maintainers of internal registries Immediately remove the compromised versions listed above from your internal package registries (e.g., JFrog Artifactory, Sonatype Nexus) or any other proxies to [npmjs.org](http://npmjs.org/). This will prevent further internal downloads of the malicious code.

Affected Versions of nx

• 21.5.0
  • Published at 6:32 PM
• 20.9.0
• 20.10.0
• 21.6.0
• 20.11.0
• 21.7.0
• 21.8.0
• 20.12.0
  • Published at 8:37 PM

These versions have since been removed from NPM as of 10:44 PM EDT

Affected…

-= Per source details. Do not edit below this line.=-

Source: ghsa-malware (8b11cb4be7497510402676b2b593e6a5d3e0dee4e1443996403e8aa496f284f3)

Summary

Malicious versions of the nx package, as well as some supporting plugin packages, were published to npm, containing code that scans the file system, collects credentials, and posts them to GitHub as a repo under user's accounts.

Immediate Actions Required

For all users, check if you were impacted

1. Check your account's audit logs (https://github.com/settings/security-log?q=action%3Arepo.create) to see if a repo containing s1ngularity-repository in the name was published to your Github account. If so your credentials were likely compromised. Unfortunately, Github may have proactively deleted the repo for you. To be safe, rotate any credentials such as Github, NPM, and anything that may have been in your environment variables.
2. Check your local machine to see if there is a file at /tmp/inventory.txt, this file will contain a list of files which the malware probably read from. If this file exists, you have been affected.
3. Check this https://github.com/[GithubSlug]?tab=repositories&q=s1ngularity-repository to see if you have a repo containing s1ngularity-repository remains on your Github account. If you do not have the repository available to you anymore, reach out to Github support and they can provide you the contents of the repository.
4. Download the file in the repo for your own records.
5. Then, remove the repo from GitHub.
6. E-mail [email protected] and we will instruct you on how to decode the file so you are aware what information was leaked
7. Rotate your credentials and tokens on all of your accounts.

Rotate your Github token

In order to rotate your Github token, follow these steps:

1. Visit https://github.com/settings/connections/applications/178c6fc778ccc68e1d6a. This is the setting for the Github app used by the gh CLI to authenticate itself.
2. Revoke access to that app. This will invalidate the OLD token which may have been compromised.
3. The next time you run the gh CLI, you will reauth and a NEW token will be generated.

If you do not do this, your Github access token may be utilized to do malicious activity on your Github account.

Rotate all of your tokens but this is specific instruction for Github to make it as easy as possible.

For all users, stop using the malicious versions

# Check if the version of nx you are using was a malicious version
npm ls nx

# If using affected versions, update immediately:
npm uninstall nx && npm install nx@latest

# Clear caches for any package manager
yarn cache clean --all 
pnpm store prune --force 
npm cache clean --force

# Remove cache directories

# Windows
%LocalAppData%/npm-cache/_npx 

# Unix
~/.npm/_npx

# Outputs of
yarn cache dir
pnpm store path

For Users Who were compromised:

Refer to the section above to see if you were compromised. If so, do the following.

• Rotate npm tokens: Visit https://www.npmjs.com/ and rotate your tokens.
• Rotate Github Tokens: Visit https://www.github.com/ and rotate your tokens.
• Change Github Credentials: Change passwords for Github
• Change your passwords for any other services you use.
• Check your .zshrc and .bashrc files for any unfamiliar lines and remove them.

Purge Malicious Versions from Internal Registries

For maintainers of internal registries Immediately remove the compromised versions listed above from your internal package registries (e.g., JFrog Artifactory, Sonatype Nexus) or any other proxies to [npmjs.org](http://npmjs.org/). This will prevent further internal downloads of the malicious code.

Affected Versions of nx

• 21.5.0
  • Published at 6:32 PM
• 20.9.0
• 20.10.0
• 21.6.0
• 20.11.0
• 21.7.0
• 21.8.0
• 20.12.0
  • Published at 8:37 PM

These versions have since been removed from NPM as of 10:44 PM EDT

Affected…