Malicious Nx npm packages included a prompt for an AI "file-search agent", per Nx

Summary

Nx advisory GHSA-cxm3-wv7p-598c: malicious versions were published. Nx says they collected credentials and posted them to GitHub. They included a script containing a prompt instructing an AI 'file-search agent' to inventory text and environment files.

Controls

Controls that could prevent, detect, or support recovery from this kind of failure. Mappings are editorial judgments made by the method, not findings about what any party should have done.

NIST AI RMF

• GOVERN 6.1 Policies address risks from third-party software and data
• MANAGE 3.1 Third-party risks are monitored and controls applied

NIST SP 800-53

• SR-3 Supply Chain Controls and Processes
• IA-5 Authenticator Management
• AC-6 Least Privilege
• SI-7 Software, Firmware, and Information Integrity

Human-approval (JCR) checkpoint

partial: agent permission prompts for dangerous flags

Correlated incidents

Co-occurrence, not cause: each link records something the two incidents share, as its rationale and source state. It does not say one incident caused the other. Links are written on one record; the other record shows the same link marked derived.

• Cyber CYB-001 Malicious nx and Nx plugin versions published to npm collected credentials, per Nx

  same CVE derived from CYB-001

  AIA-008 and this record cite the same Nx advisory, GHSA-cxm3-wv7p-598c, tracked as CVE-2025-10894.

  Source: github.com https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c

• Cyber CYB-001 Malicious nx and Nx plugin versions published to npm collected credentials, per Nx

  AI used in attack derived from CYB-001

  Nx's advisory says the malicious script contained a prompt beginning "You are a file-search agent", the AI-agent part of this event recorded in AIA-008.

  Source: github.com https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c

• Cyber CYB-003 Self-replicating "Shai-Hulud" worm compromised over 500 npm packages, per CISA

  same technique derived from CYB-003

  Both are npm package compromises that harvested credentials and published them to GitHub repositories: Shai-Hulud uploaded them to a public repository, per CISA, and the malicious nx versions posted them to GitHub, per Nx.

  Source: github.com https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c

Sources

• github.com primary link checked 2026-10-31, HTTP 200
  Published Aug 27, 2025; rated Critical; timeline Aug 21–27, 2025
  https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c

Corrections

• 2026-10-28 Verification round 1: date month confirmed (advisory published Aug 27, 2025). The advisory does not name which AI CLIs the script invoked, so the claim that it "called locally installed AI coding CLIs" was replaced with the advisory's prompt text, and "Locally installed AI coding CLIs" was removed from systems. Title reworded to match.

To report an error in this entry, see corrections.