registry / @nx/eslint / 24.0.1

@nx/eslint@24.0.1

The ESLint plugin for Nx infers tasks and provides generators and utilities used for linting JavaScript/TypeScript projects within an Nx workspace.

AI Security Review

scanned 20h ago · by lpm-firewall-ai

The inspected manifest has no install lifecycle hook, and the entry points expose Nx lint tooling. The flagged excerpts show workspace configuration, type checking, and asset handling; they do not establish malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

Importing the package exposes lint generators and utilities; generator behavior runs when invoked by an Nx workspace.

Impact

The reviewed excerpts show ordinary workspace tooling behavior and no confirmed attack impact.

Mechanism

The inspected code exports workspace lint functions, updates ESLint configuration, and performs TypeScript and asset tasks.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 79.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json identifies the package as @nx/eslint and declares no lifecycle scripts.
The main entry point exports Nx lint generators and a linter; the internal entry point re-exports configuration helpers.
The flagged ESLint utility locates and updates workspace ESLint configuration files.
The Verdaccio generator creates local registry configuration and a workspace target when invoked.
The type-check and asset-handler excerpts show TypeScript compilation and workspace asset-copy operations.
The SemVer helpers compare versions, coerce and truncate version inputs, and parse comparator and range objects.
The range helpers convert ranges to comparators, select satisfying versions, validate ranges, and check whether versions fall outside ranges.
The SemVer range helpers test intersections, simplify ranges, and use range and comparator primitives for subset checks.

Evidence against

Behavioral surface

Source

DynamicRequireEnvironmentVarsFilesystem

Supply chain

Source & flagged code

9 flagged

dist/internal.jsView file

Lines 1-28javascript

1"use strict";

2// Semi-private surface for first-party Nx packages.

3//

4// External plugins should NOT import from here — this entry is curated for

5// internal consumers and may change without semver protection. Mirrors

6// `@nx/devkit/internal`.

7Object.defineProperty(exports, "__esModule", { value: true });

9var eslint_file_1 = require("./src/generators/utils/eslint-file");

10Object.defineProperty(exports, "addExtendsToLintConfig", { enumerable: true, get: function () { return eslint_file_1.addExtendsToLintConfig; } });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/internal.jsView on unpkg · L8

11Object.defineProperty(exports, "addIgnoresToLintConfig", { enumerable: true, get: function () { return eslint_file_1.addIgnoresToLintConfig; } });

12Object.defineProperty(exports, "addOverrideToLintConfig", { enumerable: true, get: function () { return eslint_file_1.addOverrideToLintConfig; } });

13Object.defineProperty(exports, "addPluginsToLintConfig", { enumerable: true, get: function () { return eslint_file_1.addPluginsToLintConfig; } });

14Object.defineProperty(exports, "addPredefinedConfigToFlatLintConfig", { enumerable: true, get: function () { return eslint_file_1.addPredefinedConfigToFlatLintConfig; } });

15Object.defineProperty(exports, "addTypedLintingToFlatConfig", { enumerable: true, get: function () { return eslint_file_1.addTypedLintingToFlatConfig; } });

16Object.defineProperty(exports, "findEslintFile", { enumerable: true, get: function () { return eslint_file_1.findEslintFile; } });

17Object.defineProperty(exports, "inspectTypedLinting", { enumerable: true, get: function () { return eslint_file_1.inspectTypedLinting; } });

18Object.defineProperty(exports, "isEslintConfigSupported", { enumerable: true, get: function () { return eslint_file_1.isEslintConfigSupported; } });

19Object.defineProperty(exports, "isTypedLintingEnabled", { enumerable: true, get: function () { return eslint_file_1.isTypedLintingEnabled; } });

20Object.defineProperty(exports, "lintConfigHasOverride", { enumerable: true, get: function () { return eslint_file_1.lintConfigHasOverride; } });

21Object.defineProperty(exports, "replaceOverridesInLintConfig", { enumerable: true, get: function () { return eslint_file_1.replaceOverridesInLintConfig; } });

22Object.defineProperty(exports, "updateOverrideInLintConfig", { enumerable: true, get: function () { return eslint_file_1.updateOverrideInLintConfig; } });

23Object.defineProperty(exports, "updateRelativePathsInConfig", { enumerable: true, get: function () { return eslint_file_1.updateRelativePathsInConfig; } });

24var ast_utils_1 = require("./src/generators/utils/flat-config/ast-utils");

25Object.defineProperty(exports, "addImportToFlatConfig", { enumerable: true, get: function () { return ast_utils_1.addImportToFlatConfig; } });

26var flat_config_1 = require("./src/utils/flat-config");

27Object.defineProperty(exports, "useFlatConfig", { enumerable: true, get: function () { return flat_config_1.useFlatConfig; } });

28var global_eslint_config_1 = require("./src/generators/init/global-eslint-config");

Long lines were clipped for display.

dist/src/generators/utils/eslint-file.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/src/generators/utils/eslint-file.js#virtual:normalized:round1View on unpkg

package.jsonView file

Lines 1-22json

2 "name": "@nx/eslint",

3 "version": "24.0.1",

4 "private": false,

5 "type": "commonjs",

.lpm-dependency-evidence-592637b4-dece-4fa9-a3fc-cc35b046adba/1/npm-linux/dist/src/utils/typescript/run-type-check.jsView file

35async function runTypeCheck(options) { const { ts, workspaceRoot, cacheDir, config, compilerOptions } = await setupTypeScript(options); let program; let incremental = false; if (compilerOptions.incremental && cache

Low

Ai Review Evidence

The type-check and asset-handler excerpts show TypeScript compilation and workspace asset-copy operations.

.lpm-dependency-evidence-592637b4-dece-4fa9-a3fc-cc35b046adba/1/npm-linux/dist/src/utils/typescript/run-type-check.jsView on unpkg · L35

.lpm-dependency-evidence-592637b4-dece-4fa9-a3fc-cc35b046adba/1/npm-linux/dist/src/generators/setup-verdaccio/generator.jsView file

11async function setupVerdaccio(tree, options) { (0, assert_supported_typescript_version_1.[redacted])(tree); if (!tree.exists('.verdaccio/config.yml')) { (0, devkit_1.genera

Low

Ai Review Evidence

The Verdaccio generator creates local registry configuration and a workspace target when invoked.

.lpm-dependency-evidence-592637b4-dece-4fa9-a3fc-cc35b046adba/1/npm-linux/dist/src/generators/setup-verdaccio/generator.jsView on unpkg · L11

.lpm-dependency-evidence-592637b4-dece-4fa9-a3fc-cc35b046adba/1/npm-linux/dist/src/utils/assets/copy-assets-handler.jsView file

125for (const event of events) { const pathFromRoot = event.path.startsWith(this.rootDir) ? path.relative(this.rootDir, event.path) : event.path; for (const ag

Low

Ai Review Evidence

The type-check and asset-handler excerpts show TypeScript compilation and workspace asset-copy operations.

.lpm-dependency-evidence-592637b4-dece-4fa9-a3fc-cc35b046adba/1/npm-linux/dist/src/utils/assets/copy-assets-handler.jsView on unpkg · L125

dist/src/generators/utils/eslint-file.jsView file

Lines 7-47javascript

7exports.isTypedLintingEnabled = isTypedLintingEnabled;

8exports.inspectTypedLinting = inspectTypedLinting;

9exports.addTypedLintingToFlatConfig = addTypedLintingToFlatConfig;

10exports.addOverrideToLintConfig = addOverrideToLintConfig;

11exports.updateOverrideInLintConfig = updateOverrideInLintConfig;

.lpm-dependency-evidence-592637b4-dece-4fa9-a3fc-cc35b046adba/2/npm-linux/functions/gte.jsView file

3const compare = require('./compare') const gte = (a, b, loose) => compare(a, b, loose) >= 0 module.exports = gte

Low

Ai Review Evidence

The SemVer helpers compare versions, coerce and truncate version inputs, and parse comparator and range objects.

.lpm-dependency-evidence-592637b4-dece-4fa9-a3fc-cc35b046adba/2/npm-linux/functions/gte.jsView on unpkg · L3

.lpm-dependency-evidence-592637b4-dece-4fa9-a3fc-cc35b046adba/2/npm-linux/functions/lte.jsView file

3const compare = require('./compare') const lte = (a, b, loose) => compare(a, b, loose) <= 0 module.exports = lte

Low

Ai Review Evidence

The SemVer helpers compare versions, coerce and truncate version inputs, and parse comparator and range objects.

.lpm-dependency-evidence-592637b4-dece-4fa9-a3fc-cc35b046adba/2/npm-linux/functions/lte.jsView on unpkg · L3

Source & flagged code

9 flagged · loading source

dist/internal.jsView file

8exports.versions = exports.typescriptESLintVersion = exports.getInstalledEslintVersion = exports.setupRootEsLint = exports.typeScriptOverride = exports.javaScriptOverride = exports... L9: var eslint_file_1 = require("./src/generators/utils/eslint-file"); L10: Object.defineProperty(exports, "addExtendsToLintConfig", { enumerable: true, get: function () { return eslint_file_1.addExtendsToLintConfig; } });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/internal.jsView on unpkg · L8

dist/src/generators/utils/eslint-file.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/src/generators/utils/eslint-file.js#virtual:normalized:round1View on unpkg

Findings

1 High2 Medium9 Low

HighSemantic Analysis Limiteddist/src/generators/utils/eslint-file.js#virtual:normalized:round1

MediumDynamic Requiredist/internal.js

MediumEnvironment Vars

LowFilesystem

LowHigh Entropy Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidence.lpm-dependency-evidence-592637b4-dece-4fa9-a3fc-cc35b046adba/1/npm-linux/dist/src/utils/typescript/run-type-check.js

LowAi Review Evidence.lpm-dependency-evidence-592637b4-dece-4fa9-a3fc-cc35b046adba/1/npm-linux/dist/src/generators/setup-verdaccio/generator.js

LowAi Review Evidence.lpm-dependency-evidence-592637b4-dece-4fa9-a3fc-cc35b046adba/1/npm-linux/dist/src/utils/assets/copy-assets-handler.js

LowAi Review Evidencedist/src/generators/utils/eslint-file.js

Affected versions and remediation

This report applies to @nx/eslint@24.0.1.

See all versions of @nx/eslint for other recorded verdicts.

Review the evidence and your use of @nx/eslint@24.0.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-23 21:00:25.731Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @nx

Behavioral surface

Related packages

More from @nx

Source & flagged code