registry / @nx/js / 23.1.3

@nx/js@23.1.3

The JS plugin for Nx contains executors and generators that provide the best experience for developing JavaScript and TypeScript projects.

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 8 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 117 file(s), 569 KB of source, external domains: bun.sh, classic.yarnpkg.com, docs.npmjs.com, github.com, nx.dev, pnpm.io, registry.npmjs.org, yarnpkg.com

Source & flagged code

4 flagged

dist/src/executors/node/node-with-require-overrides.jsView file

Lines 1-24javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3const Module = require('module');

4const url = require('node:url');

5const originalLoader = Module._load;

6const dynamicImport = new Function('specifier', 'return import(specifier)');

7const mappings = JSON.parse(process.env.NX_MAPPINGS);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/src/executors/node/node-with-require-overrides.jsView on unpkg · L5

8const keys = Object.keys(mappings);

9const fileToRun = url.pathToFileURL(process.env.NX_FILE_TO_RUN);

10Module._load = function (request, parent) {

11 if (!parent)

12 return originalLoader.apply(this, arguments);

13 const match = keys.find((k) => request === k);

14 if (match) {

15 const newArguments = [...arguments];

16 newArguments[0] = mappings[match];

17 return originalLoader.apply(this, newArguments);

18 }

19 else {

20 return originalLoader.apply(this, arguments);

21 }

22};

23dynamicImport(fileToRun);

dist/typescript.jsView file

Lines 1-8javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.createNodesV2 = exports.createNodes = exports.createDependencies = void 0

dist/src/executors/tsc/lib/typescript-compilation.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/src/executors/tsc/lib/typescript-compilation.js#virtual:normalized:round1View on unpkg

dist/src/executors/release-publish/release-publish.impl.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @nx/js@23.0.2 matchedIdentity = npm:QG54L2pz:23.0.2 similarity = 0.719 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/executors/release-publish/release-publish.impl.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/src/executors/node/node-with-require-overrides.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code