@nx/workspace@24.0.0

⚠ Under review

The Workspace plugin contains executors and generators that are useful for any Nx workspace. It should be present in every Nx workspace and other plugins build on it.

AI Security Review

scanned 3d ago · by lpm-firewall-ai

The custom-preset path invokes a build-script approval helper, but the helper implementation in the selected nx dependency was unavailable, leaving its scope and consent behavior unresolved. Manual review is warranted; the inspected source does not establish an attack.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Running the workspace generator with a versioned custom preset.

Impact

The approval scope and consent behavior remain unresolved, so the effect on dependency script permissions cannot be determined.

Mechanism

The generator delegates approval handling to a helper re-exported by @nx/devkit from nx; the helper's implementation was unavailable for inspection.

AI rationale

Evidence

dist/src/generators/new/new.jspackage.json.lpm-dependency-evidence-fa228cea-5222-424b-b71d-5a7ebea4dcb1/0/npm-linux/dist/internal.js

Decision evidence

public snapshot

AI called this Manual Review at 84.0% confidence as Unknown with medium false-positive risk.

AI review observations

The new-workspace generator calls a declared-build-script approval helper only for custom presets with a preset version.
The inspected devkit source only re-exports that helper; its implementation comes from nx, whose selected dependency source was unresolved in the supplied snapshot.

Evidence against

The manifest identifies this as the Nx workspace package and declares nx as a dependency.
The inspected source does not establish the helper's permission scope or consent behavior.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 77 file(s), 186 KB of source, external domains: errors.nx.dev, nx.dev

Source & flagged code

7 flagged

dist/index.jsView file

Lines 1-23javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.convertToNxProjectGenerator = exports.runCommandsGenerator = exports.removeGenerator = exports.moveGenerator = exports.serializeTarget = exports.parseTarget = exports.editTarget = exports.getWorkspacePath = exports.readPackageJson = exports.output = exports.names = exports.createDirectory = exports.copyFile = exports.updateJsonFile = exports.renameSync = exports.projectRootDir = exports.ProjectType = exports.readTsConfig = void 0;

4var ts_config_1 = require("./src/utilities/ts-config");

5Object.defineProperty(exports, "readTsConfig", { enumerable: true, get: function () { return ts_config_1.readTsConfig; } });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L3

6var project_type_1 = require("./src/utils/project-type");

7Object.defineProperty(exports, "ProjectType", { enumerable: true, get: function () { return project_type_1.ProjectType; } });

8Object.defineProperty(exports, "projectRootDir", { enumerable: true, get: function () { return project_type_1.projectRootDir; } });

9var fileutils_1 = require("./src/utilities/fileutils");

10Object.defineProperty(exports, "renameSync", { enumerable: true, get: function () { return fileutils_1.renameSync; } });

11Object.defineProperty(exports, "updateJsonFile", { enumerable: true, get: function () { return fileutils_1.updateJsonFile; } });

12Object.defineProperty(exports, "copyFile", { enumerable: true, get: function () { return fileutils_1.copyFile; } });

13Object.defineProperty(exports, "createDirectory", { enumerable: true, get: function () { return fileutils_1.createDirectory; } });

14var devkit_1 = require("@nx/devkit");

15Object.defineProperty(exports, "names", { enumerable: true, get: function () { return devkit_1.names; } });

16var output_1 = require("./src/utilities/output");

17Object.defineProperty(exports, "output", { enumerable: true, get: function () { return output_1.output; } });

18var internal_1 = require("@nx/devkit/internal");

19Object.defineProperty(exports, "readPackageJson", { enumerable: true, get: function () { return internal_1.readPackageJson; } });

20var cli_config_utils_1 = require("./src/utils/cli-config-utils");

21Object.defineProperty(exports, "getWorkspacePath", { enumerable: true, get: function () { return cli_config_utils_1.getWorkspacePath; } });

22Object.defineProperty(exports, "editTarget", { enumerable: true, get: function () { return cli_config_utils_1.editTarget; } });

23Object.defineProperty(exports, "parseTarget", { enumerable: true, get: function () { return cli_config_utils_1.parseTarget; } });

dist/src/generators/move/lib/extract-base-configs.jsView file

Lines 1-25javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.maybeExtractTsConfigBase = maybeExtractTsConfigBase;

4exports.maybeExtractJestConfigBase = maybeExtractJestConfigBase;

5exports

dist/src/generators/move/lib/normalize-schema.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/src/generators/move/lib/normalize-schema.js#virtual:normalized:round1View on unpkg

dist/src/generators/new/new.jsView file

Lines 1-38javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.newGenerator = newGenerator;

4const devkit_1 = require("@nx/devkit"

.lpm-dependency-evidence-fa228cea-5222-424b-b71d-5a7ebea4dcb1/0/npm-linux/dist/internal.jsView file

21acknowledgeDeclaredBuildScripts", { enumerable: true, get: function () { return devkit_internals_1.acknowledgeDeclaredBuildScripts; } }); Object.defineProperty(exports, "createCliOptions", { enumerable: true, get: function () { re

Low

Suspicious Dependency Evidence

The inspected devkit source only re-exports that helper; its implementation comes from nx, whose selected dependency source was unresolved in the supplied snapshot.

.lpm-dependency-evidence-fa228cea-5222-424b-b71d-5a7ebea4dcb1/0/npm-linux/dist/internal.jsView on unpkg · L21

.lpm-dependency-evidence-fa228cea-5222-424b-b71d-5a7ebea4dcb1/0/npm-linux/dist/internal.d.tsView file

1export { signalToCode, [redacted], PluginCache, safeWriteFileCache, emitPluginWorkerLog, resolveImplementation, resolveSchema, ImplementationResolutionError, SchemaResolutionError,

Low

Suspicious Dependency Evidence

The inspected devkit source only re-exports that helper; its implementation comes from nx, whose selected dependency source was unresolved in the supplied snapshot.

.lpm-dependency-evidence-fa228cea-5222-424b-b71d-5a7ebea4dcb1/0/npm-linux/dist/internal.d.tsView on unpkg · L1

Source & flagged code

7 flagged · loading source

dist/index.jsView file

3exports.convertToNxProjectGenerator = exports.runCommandsGenerator = exports.removeGenerator = exports.moveGenerator = exports.serializeTarget = exports.parseTarget = exports.editT... L4: var ts_config_1 = require("./src/utilities/ts-config"); L5: Object.defineProperty(exports, "readTsConfig", { enumerable: true, get: function () { return ts_config_1.readTsConfig; } });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L3

dist/src/generators/move/lib/extract-base-configs.jsView file

5package = @nx/workspace; repositoryIdentity = nx; dependency = @nx/devkit L5: exports.[redacted] = [redacted]; L6: const devkit_1 = require("@nx/devkit"); L7: const jest_config_1 = require("../../utils/jest-config");

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/src/generators/move/lib/extract-base-configs.jsView on unpkg · L5

Findings

3 High3 Medium6 Low

HighCopied Package Dependency Bridgedist/src/generators/move/lib/extract-base-configs.js

HighSemantic Analysis Limiteddist/src/generators/move/lib/normalize-schema.js#virtual:normalized:round1

HighPrevious Version Dangerous Deltadist/src/generators/new/new.js

MediumDynamic Requiredist/index.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowAi Review Evidencedist/src/generators/new/new.js

LowSuspicious Dependency Evidence.lpm-dependency-evidence-fa228cea-5222-424b-b71d-5a7ebea4dcb1/0/npm-linux/dist/internal.js

LowSuspicious Dependency Evidence.lpm-dependency-evidence-fa228cea-5222-424b-b71d-5a7ebea4dcb1/0/npm-linux/dist/internal.d.ts

Affected versions and remediation

This report applies to @nx/workspace@24.0.0.

See all versions of @nx/workspace for other recorded verdicts.

Review the evidence and your use of @nx/workspace@24.0.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-21 20:50:05.748Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @nx

Runtime surface

Behavioral surface

Related packages

More from @nx

Source & flagged code