nx: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

nx: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "try{require('./dist/bin/post-install')}catch(e){}"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node -e "try{require('./dist/bin/post-install')}catch(e){}"

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/bin/nx.jsView file

18const strip_indents_1 = require("../src/utils/strip-indents"); L19: const child_process_1 = require("child_process"); L20: const module_1 = require("module");

High

Child Process

Package source references child process execution.

dist/bin/nx.jsView on unpkg · L18

dist/src/utils/git-utils.index-filter.jsView file

11const { execSync } = require('child_process'); L12: // NOTE: Using env vars because Windows PowerShell has its own handling of quotes (") messes up quotes in args, even if escaped. L13: const src = process.env.NX_IMPORT_SOURCE;

High

Shell

Package source references shell execution.

dist/src/utils/git-utils.index-filter.jsView on unpkg · L11

dist/src/core/graph/runtime.jsView file

1(()=>{"use strict";var e,r={},t={};function n(e){var o=t[e];if(void 0!==o)return o.exports;var i=t[e]={exports:{}};return r[e](i,i.exports,n),i.exports}n.m=r,e=[],n.O=(r,t,o,i)=>{i...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/src/core/graph/runtime.jsView on unpkg · L1

dist/bin/nx-cloud.jsView file

4exports.invokeCommandWithNxCloudClient = invokeCommandWithNxCloudClient; L5: const get_cloud_options_1 = require("../src/nx-cloud/utilities/get-cloud-options"); L6: const update_manager_1 = require("../src/nx-cloud/update-manager");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/bin/nx-cloud.jsView on unpkg · L4

dist/src/utils/git-utils.jsView file

13const tslib_1 = require("tslib"); L14: const child_process_1 = require("child_process"); L15: const crypto = tslib_1.__importStar(require("crypto")); ... L20: return new Promise((res, rej) => { L21: (0, child_process_1.exec)(command, { ...execOptions, windowsHide: true }, (err, stdout, stderr) => { L22: if (err) { ... L84: } L85: async fetch(remote, ref) { L86: return await this.execAsync(`git fetch ${remote}${ref ? ` ${ref}` : ''}`); ... L135: if (source !== '') { L136: const indexFilterCommand = this.quoteArg(`node ${(0, path_1.join)(__dirname, 'git-utils.index-filter.js')}`); L137: await this.execAsync(`git filter-branch -f --index-filter ${indexFilterCommand} --prune-empty -- ${branchName}`, {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/src/utils/git-utils.jsView on unpkg · L13

dist/src/command-line/completion/scripts.jsView file

7exports.generateScript = generateScript; L8: const child_process_1 = require("child_process"); L9: const fs_1 = require("fs"); ... L12: exports.SHELLS = ['bash', 'zsh', 'fish', 'powershell']; L13: /** Print the raw wrapper script to stdout — for scripting / custom rc paths. */ L14: function printCompletionScript(shell) { L15: process.stdout.write(generateScript(shell)); L16: } ... L79: case 'bash': L80: return [(0, path_1.join)(home, '.bashrc')]; L81: case 'zsh': ... L97: function resolvePowerShellProfiles() {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/src/command-line/completion/scripts.jsView on unpkg · L7

dist/src/utils/ab-testing.jsView file

116catch (e) { L117: if (process.env.NX_VERBOSE_LOGGING === 'true') { L118: console.error(e); ... L125: // Fallback on true as Package management doesn't support reading config for registry. L126: // currently Bun doesn't support fetching config settings https://github.com/oven-sh/bun/issues/7140 L127: return true; ... L129: try { L130: const stdout = (0, node_child_process_1.execSync)(pmc.getRegistryUrl, { L131: encoding: 'utf-8',

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/utils/ab-testing.jsView on unpkg · L116

dist/src/native/nx.wasm32-wasi.wasmView file

•path = dist/src/native/nx.wasm32-wasi.wasm kind = wasm_module sizeBytes = 4053496 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/src/native/nx.wasm32-wasi.wasmView on unpkg

dist/src/command-line/completion/scripts/fish.fishView file

•path = dist/src/command-line/completion/scripts/fish.fish kind = build_helper sizeBytes = 1538 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/src/command-line/completion/scripts/fish.fishView on unpkg

dist/src/core/graph/main.jsView file

•path = dist/src/core/graph/main.js kind = oversized_source_file sizeBytes = 2934421 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/src/core/graph/main.jsView on unpkg

dist/src/command-line/init/implementation/utils.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = nx@23.0.2 matchedIdentity = npm:bng:23.0.2 similarity = 0.933 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/command-line/init/implementation/utils.jsView on unpkg

Source & flagged code

13 flagged

package.jsonView file

Lines 515-537json

515 "types": "./dist/release/*.d.ts",

516 "default": "./dist/release/*.js"

517 },

518 "./release/*.js": {

519 "@nx/nx-source": "./release/*.ts",

520 "types": "./dist/release/*.d.ts",

521 "default": "./dist/release/*.js"

522 },

523 "./tasks-runners/*": {

524 "@nx/nx-source": "./tasks-runners/*.ts",

525 "types": "./dist/tasks-runners/*.d.ts",

526 "default": "./dist/tasks-runners/*.js"

527 },

528 "./tasks-runners/*.js": {

529 "@nx/nx-source": "./tasks-runners/*.ts",

530 "types": "./dist/tasks-runners/*.d.ts",

531 "default": "./dist/tasks-runners/*.js"

532 }

533 },

534 "scripts": {

535 "postinstall": "node -e \"try{require('./dist/bin/post-install')}catch(e){}\""

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L535

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L535

536 }

537}

dist/bin/nx.jsView file

Lines 1-38javascript

1#!/usr/bin/env node

2"use strict";

3// TODO: Remove this workaround once picocolors handles FORCE_COLOR=0 correctly

4// See: https://github.com/alexeyraspopov/picocolors/issues/100

5Object.defineProperty(exports, "__esModule", { value: true });

6const tslib_1 = require

dist/src/utils/git-utils.index-filter.jsView file

Lines 1-24javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3/**

4 * This is meant to be used with `git filter-branch --index-filter` to rewrite

5 * history such that only commits related to the subdirectory is kept.

6 *

7 * Example:

8

dist/src/core/graph/runtime.jsView file

Lines 1-1javascript

1(()=>{"use strict";var e,r={},t={};function n(e){var o=t[e];if(void 0!==o)return

dist/bin/nx-cloud.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2"use strict";

3Object.defineProperty(exports, "__esModule", { value: true });

4exports.invokeCommandWithNxCloudClient = invokeCommandWithNxCloudClient;

5const get_cloud_options_1 =

dist/src/utils/git-utils.jsView file

Lines 1-33javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.GitRepository = void 0;

4exports.cloneFromUpstream = cloneFromUpstream;

dist/src/command-line/completion/scripts.jsView file

Lines 1-27javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.SHELLS = void 0;

4exports.printCompletionScript =

dist/src/utils/ab-testing.jsView file

116catch (e) { L117: if (process.env.NX_VERBOSE_LOGGING === 'true') { L118: console.error(e); ... L125: // Fallback on true as Package management doesn't support reading config for registry. L126: // currently Bun doesn't support fetching config settings https://github.com/oven-sh/bun/issues/7140 L127: return true; ... L129: try { L130: const stdout = (0, node_child_process_1.execSync)(pmc.getRegistryUrl, { L131: encoding: 'utf-8',

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/utils/ab-testing.jsView on unpkg · L116

dist/src/native/nx.wasm32-wasi.wasmView file

•path = dist/src/native/nx.wasm32-wasi.wasm kind = wasm_module sizeBytes = 4053496 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/src/native/nx.wasm32-wasi.wasmView on unpkg

dist/src/command-line/completion/scripts/fish.fishView file

•path = dist/src/command-line/completion/scripts/fish.fish kind = build_helper sizeBytes = 1538 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/src/command-line/completion/scripts/fish.fishView on unpkg

dist/src/core/graph/main.jsView file

•path = dist/src/core/graph/main.js kind = oversized_source_file sizeBytes = 2934421 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/src/core/graph/main.jsView on unpkg

dist/src/command-line/init/implementation/utils.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = nx@23.0.2 matchedIdentity = npm:bng:23.0.2 similarity = 0.933 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/command-line/init/implementation/utils.jsView on unpkg