registry / @nx/js / 24.0.0

@nx/js@24.0.0

⚠ Under review

The JS plugin for Nx contains executors and generators that provide the best experience for developing JavaScript and TypeScript projects.

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 8 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 140 file(s), 671 KB of source, external domains: bun.sh, classic.yarnpkg.com, docs.npmjs.com, github.com, nx.dev, pnpm.io, registry.npmjs.org, yarnpkg.com

Source & flagged code

4 flagged

dist/src/executors/node/node-with-require-overrides.jsView file

Lines 1-24javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3const Module = require('module');

4const url = require('node:url');

5const originalLoader = Module._load;

6const dynamicImport = new Function('specifier', 'return import(specifier)');

7const mappings = JSON.parse(process.env.NX_MAPPINGS);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/src/executors/node/node-with-require-overrides.jsView on unpkg · L5

8const keys = Object.keys(mappings);

9const fileToRun = url.pathToFileURL(process.env.NX_FILE_TO_RUN);

10Module._load = function (request, parent) {

11 if (!parent)

12 return originalLoader.apply(this, arguments);

13 const match = keys.find((k) => request === k);

14 if (match) {

15 const newArguments = [...arguments];

16 newArguments[0] = mappings[match];

17 return originalLoader.apply(this, newArguments);

18 }

19 else {

20 return originalLoader.apply(this, arguments);

21 }

22};

23dynamicImport(fileToRun);

dist/typescript.jsView file

Lines 1-7javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.createNodesV2 = exports.createNodes = void 0;

4var plugin_1

dist/src/executors/tsc/lib/typescript-compilation.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/src/executors/tsc/lib/typescript-compilation.js#virtual:normalized:round1View on unpkg

dist/src/executors/release-publish/release-publish.impl.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @nx/js@23.2.1 matchedIdentity = npm:QG54L2pz:23.2.1 similarity = 0.767 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/executors/release-publish/release-publish.impl.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/src/executors/node/node-with-require-overrides.jsView file

5const originalLoader = Module._load; L6: const dynamicImport = new Function('specifier', 'return import(specifier)'); L7: const mappings = JSON.parse(process.env.NX_MAPPINGS);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/src/executors/node/node-with-require-overrides.jsView on unpkg · L5

dist/typescript.jsView file

3exports.createNodesV2 = exports.createNodes = void 0; L4: var plugin_1 = require("./src/plugins/typescript/plugin"); L5: Object.defineProperty(exports, "createNodes", { enumerable: true, get: function () { return plugin_1.createNodes; } });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/typescript.jsView on unpkg · L3

dist/src/executors/tsc/lib/typescript-compilation.js#virtual:normalized:round1

Findings

2 High2 Medium4 Low

HighSemantic Analysis Limiteddist/src/executors/tsc/lib/typescript-compilation.js#virtual:normalized:round1

HighPrevious Version Dangerous Deltadist/src/executors/release-publish/release-publish.impl.js

MediumDynamic Requiredist/typescript.js

MediumEnvironment Vars

LowEvaldist/src/executors/node/node-with-require-overrides.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @nx/js@24.0.0.

See all versions of @nx/js for other recorded verdicts.

Review the evidence and your use of @nx/js@24.0.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-21 23:06:18.830Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @nx

Behavioral surface

Related packages

More from @nx

Source & flagged code