registry / @nx/workspace / 23.1.2

@nx/workspace@23.1.2

The Workspace plugin contains executors and generators that are useful for any Nx workspace. It should be present in every Nx workspace and other plugins build on it.

AI Security Review

scanned 16d ago · by lpm-firewall-ai

The flagged dynamic loading and child-process use are consistent with Nx generators and workspace creation. Inspected sources show no concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Calling the workspace preset generator to create a workspace.

Impact

Creates a workspace; the inspected code provides no evidence of secret collection, unrelated network activity, or malicious mutation.

Mechanism

The generator resolves the Nx executable within the new workspace and forks it with arguments derived from the supplied preset options.

AI rationale

The flagged dynamic loading and child-process use are consistent with Nx generators and workspace creation. Inspected sources show no concrete malicious behavior.

Decision evidence

public snapshot

AI called this Clean at 95.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest identifies the Nx workspace entry point and package metadata.
Optional Nx plugin helpers invoke generators only when those plugins are installed.
Project move normalization validates and derives project naming and destination options.
Workspace creation resolves the local Nx CLI and forwards preset options to it.

Evidence against

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 77 file(s), 178 KB of source, external domains: errors.nx.dev, nx.dev

Source & flagged code

7 flagged

dist/index.jsView file

Lines 1-23javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.convertToNxProjectGenerator = exports.runCommandsGenerator = exports.removeGenerator = exports.moveGenerator = exports.serializeTarget = exports.parseTarget = exports.editTarget = exports.getWorkspacePath = exports.readPackageJson = exports.output = exports.names = exports.createDirectory = exports.copyFile = exports.updateJsonFile = exports.renameSync = exports.projectRootDir = exports.ProjectType = exports.readTsConfig = void 0;

4var ts_config_1 = require("./src/utilities/ts-config");

5Object.defineProperty(exports, "readTsConfig", { enumerable: true, get: function () { return ts_config_1.readTsConfig; } });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L3

6var project_type_1 = require("./src/utils/project-type");

7Object.defineProperty(exports, "ProjectType", { enumerable: true, get: function () { return project_type_1.ProjectType; } });

8Object.defineProperty(exports, "projectRootDir", { enumerable: true, get: function () { return project_type_1.projectRootDir; } });

9var fileutils_1 = require("./src/utilities/fileutils");

10Object.defineProperty(exports, "renameSync", { enumerable: true, get: function () { return fileutils_1.renameSync; } });

11Object.defineProperty(exports, "updateJsonFile", { enumerable: true, get: function () { return fileutils_1.updateJsonFile; } });

12Object.defineProperty(exports, "copyFile", { enumerable: true, get: function () { return fileutils_1.copyFile; } });

13Object.defineProperty(exports, "createDirectory", { enumerable: true, get: function () { return fileutils_1.createDirectory; } });

14var devkit_1 = require("@nx/devkit");

15Object.defineProperty(exports, "names", { enumerable: true, get: function () { return devkit_1.names; } });

16var output_1 = require("./src/utilities/output");

17Object.defineProperty(exports, "output", { enumerable: true, get: function () { return output_1.output; } });

18var internal_1 = require("@nx/devkit/internal");

19Object.defineProperty(exports, "readPackageJson", { enumerable: true, get: function () { return internal_1.readPackageJson; } });

20var cli_config_utils_1 = require("./src/utils/cli-config-utils");

21Object.defineProperty(exports, "getWorkspacePath", { enumerable: true, get: function () { return cli_config_utils_1.getWorkspacePath; } });

22Object.defineProperty(exports, "editTarget", { enumerable: true, get: function () { return cli_config_utils_1.editTarget; } });

23Object.defineProperty(exports, "parseTarget", { enumerable: true, get: function () { return cli_config_utils_1.parseTarget; } });

dist/src/generators/move/lib/extract-base-configs.jsView file

Lines 1-28javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.maybeExtractTsConfigBase = maybeExtractTsConfigBase;

4exports.maybeExtractJestConfigBase = maybeExtractJestConfigBase;

5exports

dist/src/generators/move/lib/normalize-schema.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/src/generators/move/lib/normalize-schema.js#virtual:normalized:round1View on unpkg

dist/src/generators/new/generate-preset.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @nx/workspace@23.2.1 matchedIdentity = npm:QG54L3dvcmtzcGFjZQ:23.2.1 similarity = 0.904 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/generators/new/generate-preset.jsView on unpkg

package.jsonView file

Lines 10-50json

10 "executors.json",

11 "generators.json"

12 ],

13 "description": "The Workspace plugin contains executors and generators that are useful for any Nx workspace. It should be present in every Nx workspace and other plugins build on it.",

14 "repository": {

15 "type": "git",

dist/src/generators/move/lib/normalize-schema.jsView file

Lines 1-28javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.normalizeSchema = normalizeSchema;

4const devkit_1 = require(

Source & flagged code

7 flagged · loading source

dist/index.jsView file

3exports.convertToNxProjectGenerator = exports.runCommandsGenerator = exports.removeGenerator = exports.moveGenerator = exports.serializeTarget = exports.parseTarget = exports.editT... L4: var ts_config_1 = require("./src/utilities/ts-config"); L5: Object.defineProperty(exports, "readTsConfig", { enumerable: true, get: function () { return ts_config_1.readTsConfig; } });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L3

dist/src/generators/move/lib/extract-base-configs.jsView file

5package = @nx/workspace; repositoryIdentity = nx; dependency = @nx/devkit L5: exports.[redacted] = [redacted]; L6: const devkit_1 = require("@nx/devkit"); L7: const jest_config_1 = require("../../utils/jest-config");

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/src/generators/move/lib/extract-base-configs.jsView on unpkg · L5

Findings

3 High3 Medium6 Low

HighCopied Package Dependency Bridgedist/src/generators/move/lib/extract-base-configs.js

HighSemantic Analysis Limiteddist/src/generators/move/lib/normalize-schema.js#virtual:normalized:round1

HighPrevious Version Dangerous Deltadist/src/generators/new/generate-preset.js

MediumDynamic Requiredist/index.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowAi Review Evidencepackage.json

LowAi Review Evidencedist/src/generators/move/lib/extract-base-configs.js

LowAi Review Evidencedist/src/generators/move/lib/normalize-schema.js

Affected versions and remediation

This report applies to @nx/workspace@23.1.2.

See all versions of @nx/workspace for other recorded verdicts.

Review the evidence and your use of @nx/workspace@23.1.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-08 20:04:03.707Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @nx

Behavioral surface

Related packages

More from @nx

Source & flagged code