@nx/js: Clean npm security report (Allow)

Loading npm security reports…

Static Scan Results

scanned 11d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 7 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 114 file(s), 528 KB of source, external domains: bun.sh, classic.yarnpkg.com, docs.npmjs.com, github.com, nx.dev, pnpm.io, registry.npmjs.org, yarnpkg.com

Source & flagged code

3 flagged

dist/src/executors/node/node-with-require-overrides.jsView file

Lines 1-24javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3const Module = require('module');

4const url = require('node:url');

5const originalLoader = Module._load;

6const dynamicImport = new Function('specifier', 'return import(specifier)');

7const mappings = JSON.parse(process.env.NX_MAPPINGS);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/src/executors/node/node-with-require-overrides.jsView on unpkg · L5

8const keys = Object.keys(mappings);

9const fileToRun = url.pathToFileURL(process.env.NX_FILE_TO_RUN);

10Module._load = function (request, parent) {

11 if (!parent)

12 return originalLoader.apply(this, arguments);

13 const match = keys.find((k) => request === k);

14 if (match) {

15 const newArguments = [...arguments];

16 newArguments[0] = mappings[match];

17 return originalLoader.apply(this, newArguments);

18 }

19 else {

20 return originalLoader.apply(this, arguments);

21 }

22};

23dynamicImport(fileToRun);

dist/typescript.jsView file

Lines 1-8javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.createNodesV2 = exports.createNodes = exports.createDependencies = void 0

dist/src/executors/node/node.impl.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @nx/js@23.0.1 matchedIdentity = npm:QG54L2pz:23.0.1 similarity = 0.947 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/executors/node/node.impl.jsView on unpkg

Source & flagged code

3 flagged · loading source

dist/src/executors/node/node-with-require-overrides.jsView file

@nx/js: Clean npm security report (Allow) | LPM Firewall

@nx/js@23.0.2

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code