@nx/workspace@23.1.3: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@nx/workspace@23.1.3: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

6 flagged · loading source

dist/index.jsView file

3exports.convertToNxProjectGenerator = exports.runCommandsGenerator = exports.removeGenerator = exports.moveGenerator = exports.serializeTarget = exports.parseTarget = exports.editT... L4: var ts_config_1 = require("./src/utilities/ts-config"); L5: Object.defineProperty(exports, "readTsConfig", { enumerable: true, get: function () { return ts_config_1.readTsConfig; } });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L3

dist/src/generators/move/lib/extract-base-configs.jsView file

5package = @nx/workspace; repositoryIdentity = nx; dependency = @nx/devkit L5: exports.[redacted] = [redacted]; L6: const devkit_1 = require("@nx/devkit"); L7: const jest_config_1 = require("../../utils/jest-config");

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/src/generators/move/lib/extract-base-configs.jsView on unpkg · L5

dist/src/generators/move/lib/normalize-schema.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/src/generators/move/lib/normalize-schema.js#virtual:normalized:round1View on unpkg

dist/src/generators/new/generate-preset.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @nx/workspace@23.0.1 matchedIdentity = npm:QG54L3dvcmtzcGFjZQ:23.0.1 similarity = 0.844 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/generators/new/generate-preset.jsView on unpkg

dist/src/generators/new/generate-workspace-files.jsView file

135let aiAgentsCallback = undefined; if (options.aiAgents && options.aiAgents.length > 0) { aiAgentsCallback = await (0, internal_1.setupAiAgentsGenerator)(tree, { directory: options.directory, writeNxCloudRules: options.nxCloud !== 'skip', packageVersion: 'latest', agents: [...options.aiAgents], }); }

Medium

Ai Review Evidence

The workspace generator conditionally calls an AI-agent setup helper with caller-selected agents.

dist/src/generators/new/generate-workspace-files.jsView on unpkg · L135

dist/src/generators/new/new.jsView file

29// TODO: move all of these into create-nx-workspace if (options.preset !== presets_1.Preset.NPM && !options.isCustomPreset) { await (0, generate_preset_1.generatePreset)(tree, options); } // if we move this into create-nx-workspace, we can also easily log things out like nx console install success if (aiAgentsCallback) { await aiAgentsCallback(); }

Medium

Ai Review Evidence

Its returned callback runs after the user-invoked workspace setup task.

dist/src/generators/new/new.jsView on unpkg · L29

Source & flagged code

6 flagged

dist/index.jsView file

Lines 1-23javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.convertToNxProjectGenerator = exports.runCommandsGenerator = exports.removeGenerator = exports.moveGenerator = exports.serializeTarget = exports.parseTarget = exports.editTarget = exports.getWorkspacePath = exports.readPackageJson = exports.output = exports.names = exports.createDirectory = exports.copyFile = exports.updateJsonFile = exports.renameSync = exports.projectRootDir = exports.ProjectType = exports.readTsConfig = void 0;

4var ts_config_1 = require("./src/utilities/ts-config");

5Object.defineProperty(exports, "readTsConfig", { enumerable: true, get: function () { return ts_config_1.readTsConfig; } });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L3

6var project_type_1 = require("./src/utils/project-type");

7Object.defineProperty(exports, "ProjectType", { enumerable: true, get: function () { return project_type_1.ProjectType; } });

8Object.defineProperty(exports, "projectRootDir", { enumerable: true, get: function () { return project_type_1.projectRootDir; } });

9var fileutils_1 = require("./src/utilities/fileutils");

10Object.defineProperty(exports, "renameSync", { enumerable: true, get: function () { return fileutils_1.renameSync; } });

11Object.defineProperty(exports, "updateJsonFile", { enumerable: true, get: function () { return fileutils_1.updateJsonFile; } });

12Object.defineProperty(exports, "copyFile", { enumerable: true, get: function () { return fileutils_1.copyFile; } });

13Object.defineProperty(exports, "createDirectory", { enumerable: true, get: function () { return fileutils_1.createDirectory; } });

14var devkit_1 = require("@nx/devkit");

15Object.defineProperty(exports, "names", { enumerable: true, get: function () { return devkit_1.names; } });

16var output_1 = require("./src/utilities/output");

17Object.defineProperty(exports, "output", { enumerable: true, get: function () { return output_1.output; } });

18var internal_1 = require("@nx/devkit/internal");

19Object.defineProperty(exports, "readPackageJson", { enumerable: true, get: function () { return internal_1.readPackageJson; } });

20var cli_config_utils_1 = require("./src/utils/cli-config-utils");

21Object.defineProperty(exports, "getWorkspacePath", { enumerable: true, get: function () { return cli_config_utils_1.getWorkspacePath; } });

22Object.defineProperty(exports, "editTarget", { enumerable: true, get: function () { return cli_config_utils_1.editTarget; } });

23Object.defineProperty(exports, "parseTarget", { enumerable: true, get: function () { return cli_config_utils_1.parseTarget; } });

dist/src/generators/move/lib/extract-base-configs.jsView file

Lines 1-25javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.maybeExtractTsConfigBase = maybeExtractTsConfigBase;

4exports.maybeExtractJestConfigBase = maybeExtractJestConfigBase;

5exports

dist/src/generators/move/lib/normalize-schema.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/src/generators/move/lib/normalize-schema.js#virtual:normalized:round1View on unpkg

dist/src/generators/new/generate-preset.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @nx/workspace@23.0.1 matchedIdentity = npm:QG54L3dvcmtzcGFjZQ:23.0.1 similarity = 0.844 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/generators/new/generate-preset.jsView on unpkg

dist/src/generators/new/generate-workspace-files.jsView file

Lines 115-155javascript

115 },

116};

117async function generateWorkspaceFiles(tree, options) {

118 if (!options.name) {

119 throw new

dist/src/generators/new/new.jsView file

Lines 9-49javascript

9const child_process_1 = require("child_process");

10async function newGenerator(tree, opts) {

11 const options =