ACVERogue and malicious agent events

Advisories › ACVE-2026-0405

ACVE-2026-0405 · Real incident · CRITICAL

Unverified · secondary sources only

WHAT HAPPENED

The postinstall drives the installed AI CLI to inventory and collect credential files, then exfiltrates them to a GitHub repository under the victim's account.

THE SETUP — is yours like this?

Harness
Any machine or CI job that installed a listed nx or @nx/* version and had an AI CLI (Claude, Gemini or Q) installed for the payload to drive, github.com
Model
The default model of whichever installed CLI the payload invoked (Claude, Gemini or Q) (detected), www.wiz.io
Goal
A file-search agent task: search the filesystem, list configuration and environment-definition files and write the inventory of paths to /tmp/inventory.txt using available tools, github.com
Tools
The postinstall telemetry script; the installed AI CLI invoked with --dangerously-skip-permissions, --yolo and --trust-all-tools; /tmp/inventory.txt; a GitHub repository named s1ngularity-repository in the victim account, www.wiz.io
Approval
The payload passed the CLI its own permission-bypass flags (--dangerously-skip-permissions, --yolo, --trust-all-tools), so the agent acted without prompting regardless of the user's settings, www.wiz.io

WHAT TO CHANGE

Replace any listed version with a clean release and rotate credentials.

  • Upgrade npm:nx to 21.5.1. First stable nx release published to npm after the malicious versions were removed. Owner: operator
  • Reconfigure nx.release to the fix in nrwl/nx pull request 32458. Shipped by Nx: its advisory GHSA-cxm3-wv7p-598c marks the issue fixed. Owner: tool-provider
  • Reconfigure harness.cli.permissionBypassFlags to can be switched off in the user's settings. Recommended: the payload passed each CLI its own bypass flag, so the agent ran unprompted whatever the user's settings. Owner: harness-vendor

HARM, REACH AND RECOVERY

Harm
credential-theft
Reach
The machine's credential and wallet files, and GitHub, github.com (API keys, cloud credentials, a wallet, private repositories)
Condition
When a poisoned nx version is installed on a machine with an AI CLI present, github.com
Evidence and responses
Real use · vendor report
Nx fixed — github.com

SOURCES

ADVISORY

FIX

REPORT

Technical details

Secrets are collected and exfiltrated to the victim's own GitHub account when a listed nx or @nx/* version is installed: its postinstall drives an installed AI CLI with permission-bypass flags.

Severity
CRITICAL · CVSS
Status
Unverified
Kind
Real incident
Modified
2026-09-25
Aliases
CVE-2025-10894, GHSA-cxm3-wv7p-598c
CVE boundary
supply-chain
Affected
  • npm: nx — >= 20.9.0, <= 20.9.0; >= 20.10.0, <= 20.10.0; >= 20.11.0, <= 20.11.0; >= 20.12.0, <= 20.12.0; >= 21.5.0, <= 21.5.0; >= 21.6.0, <= 21.6.0; >= 21.7.0, <= 21.7.0; >= 21.8.0, <= 21.8.0
  • npm: @nx/devkit — >= 20.9.0, <= 20.9.0; >= 21.5.0, <= 21.5.0
  • npm: @nx/js — >= 20.9.0, <= 20.9.0; >= 21.5.0, <= 21.5.0
  • npm: @nx/workspace — >= 20.9.0, <= 20.9.0; >= 21.5.0, <= 21.5.0
  • npm: @nx/node — >= 20.9.0, <= 20.9.0; >= 21.5.0, <= 21.5.0
  • npm: @nx/eslint — >= 21.5.0, <= 21.5.0
  • npm: @nx/key — >= 3.2.0, <= 3.2.0
  • npm: @nx/enterprise-cloud — >= 3.2.0, <= 3.2.0
Harness/product
nx + @nx/devkit + @nx/js + @nx/workspace + @nx/node + @nx/eslint + @nx/key + @nx/enterprise-cloud
Classes
supply-chain; credential-theft; CWE-506
Taxonomy
ASI: ASI04; ASI: ASI03; ATLAS: AML.T0011.001; ATLAS: AML.T0103; ATLAS: AML.T0055
First reported
2025-08-27 — Nx (GitHub advisory)
Input controlled by
package-publisher
Divergence
instruction-followed
Licence
CC-BY-4.0 advisories; MIT code

Reproducibility: not-reproducible (vulnerable components are not confirmed obtainable; trigger not published)

Claims

Confirmed means the statement matches the cited primary source. Nothing on this page has been reproduced.

ClaimStatusSourceChecked
Identifier CVE-2025-10894Confirmedcveawg.mitre.org2026-09-23
Identifier GHSA-cxm3-wv7p-598cConfirmedapi.osv.dev2026-09-23
Affected through 20.9.0Confirmedapi.osv.dev2026-09-23
Affected through 20.10.0Confirmedapi.osv.dev2026-09-23
Affected through 20.11.0Confirmedapi.osv.dev2026-09-23
Affected through 20.12.0Confirmedapi.osv.dev2026-09-23
Affected versions include 21.5.0Confirmedapi.osv.dev2026-09-23
Affected through 21.6.0Confirmedapi.osv.dev2026-09-23
Affected through 21.7.0Confirmedapi.osv.dev2026-09-23
Affected through 21.8.0Confirmedapi.osv.dev2026-09-23
Affected versions include 3.2.0Confirmedapi.osv.dev2026-09-23
Upgrade target 21.5.1Confirmedregistry.npmjs.org2026-09-23
Severity CRITICAL (CVSS 9.6); matches CNAConfirmedcveawg.mitre.org2026-09-23
Affected versions include 20.9.0, 20.10.0, 20.11.0, 20.12.0, 21.5.0, 21.6.0, 21.7.0, 21.8.0Confirmedapi.osv.dev2026-09-23
Affected versions include 20.9.0, 21.5.0Confirmedapi.osv.dev2026-09-23
Latest affected version 21.8.0 is no longer on npm — Matches npm; version not found on npmUnavailableregistry.npmjs.org2026-09-22
Latest affected version 21.5.0 is no longer on npm — Matches npm; version not found on npmUnavailableregistry.npmjs.org2026-09-22
Latest affected version 3.2.0 is no longer on npm — Matches npm; version not found on npmUnavailableregistry.npmjs.org2026-09-22

Description

What

A 2025 event. The listed versions were published between 6:32 PM and 8:37 PM EDT on 2025-08-26 and removed by 6:20 AM the next day. The postinstall script collected credentials and pushed them to s1ngularity-repository repositories in the victim's GitHub account. Wiz reports it invoked installed Claude, Gemini and Q CLIs with --dangerously-skip-permissions, --yolo and --trust-all-tools to find secrets. On 2025-08-28 and 08-29 stolen tokens were used to make private repositories public.

Detection

acve lock does not inventory npm dependency trees, so this record has no matcher: run npm ls nx and check for /tmp/inventory.txt.

Fix

Install a clean release, clear package-manager caches and rotate GitHub, npm and cloud credentials.

Report a problemJSON