https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T16:23:02.296621+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2025-10894 CVE-2025-10894 — Nx: nx/devkit: malicious versions of nx and plugins published to npm 2026-10-07T16:23:02.329088+00:00

Affected: nx, nx/devkit, nx/enterprise-cloud, nx/eslint, nx/js, nx/key, nx/node, nx/workspace, Red Hat Multicluster Global Hub, Red Hat OpenShift Serverless and 2 more

Malicious code was inserted into the Nx (build system) package and several related plugins. The tampered package was published to the npm software registry, via a supply-chain attack. Affected versions contain code that scans the file system, collects credentials, and posts them to GitHub as a repo under user's accounts.

 https://cve.radiocsirt.org/vuln/ghsa-cxm3-wv7p-598c Withdrawn: GHSA-cxm3-wv7p-598c — Malicious versions of Nx were published 2026-10-07T16:23:02.329164+00:00

Withdrawn by the publisher.

Affected: npm: nx, npm: @nx/key, npm: @nx/enterprise-cloud, npm: @nx/devkit, npm: @nx/js, npm: @nx/workspace, npm: @nx/eslint, npm: @nx/node

## Summary

Malicious versions of the [`nx` package](https://www.npmjs.com/package/nx), as well as some supporting plugin packages, were published to npm, containing code that scans the file system, collects credentials, and posts them to GitHub as a repo under user's accounts.

## Immediate Actions Required

### For all users, check if you were impacted

1. Check your account's audit logs (https://github.com/settings/security-log?q=action%3Arepo.create) to see if a repo containing s1ngularity-repository in the name was published to your Github account. If so your credentials were likely compromised. Unfortunately, Github may have proactively deleted the repo for you. To be safe, rotate any credentials such as Github, NPM, and anything that may have been in your environment variables. 2. Check your local machine to see if there is a file at `/tmp/inventory.txt`, this file will contain a list of files which the malware probably read from. If this file exists, you have been affected. 3. Check this https://github.com/[GithubSlug]?tab=repositories&q=s1ngularity-repository to see if you have a repo containing s1ngularity-repository remains on your Github account. If you do not have the repository available to you anymore, reach out to Github support and they can provide you the contents of the repository. 4. Download the file in the repo for your own records. 5. Then, remove the repo from GitHub. 6. E-mail security@nrwl.io and we will instruct you on how to decode the file so you…