GHSA-8mjq-32x3-22qf

Suggest an improvement
Source
https://github.com/advisories/GHSA-8mjq-32x3-22qf
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-8mjq-32x3-22qf/GHSA-8mjq-32x3-22qf.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-8mjq-32x3-22qf
Withdrawn
2025-09-25T16:34:25Z
Published
2025-09-25T00:30:27Z
Modified
2025-09-25T16:34:25Z
Severity
  • 9.6 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Duplicate Advisory: Malicious versions of Nx were published
Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-cxm3-wv7p-598c. This link is maintained to preserve external references.

Original Description

Malicious code was inserted into the Nx (build system) package and several related plugins. The tampered package was published to the npm software registry, via a supply-chain attack. Affected versions contain code that scans the file system, collects credentials, and posts them to GitHub as a repo under user's accounts.

Database specific 
{
    "cwe_ids":  [
        "CWE-506"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-09-25T16:34:25Z",
    "nvd_published_at":  "2025-09-24T22:15:35Z",
    "severity":  "CRITICAL"
}
References

Affected packages

npm / nx

Package

Name
nx
View open source insights on deps.dev
Purl
pkg:npm/nx

Affected ranges

Affected versions

21.*
21.5.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-8mjq-32x3-22qf/GHSA-8mjq-32x3-22qf.json"