nx@23.0.1: Suspicious npm security report (Warn)

Loading npm security reports…

Source & flagged code

12 flagged

package.jsonView file

Lines 511-533json

511 "types": "./dist/release/*.d.ts",

512 "default": "./dist/release/*.js"

513 },

514 "./release/*.js": {

515 "@nx/nx-source": "./release/*.ts",

516 "types": "./dist/release/*.d.ts",

517 "default": "./dist/release/*.js"

518 },

519 "./tasks-runners/*": {

520 "@nx/nx-source": "./tasks-runners/*.ts",

521 "types": "./dist/tasks-runners/*.d.ts",

522 "default": "./dist/tasks-runners/*.js"

523 },

524 "./tasks-runners/*.js": {

525 "@nx/nx-source": "./tasks-runners/*.ts",

526 "types": "./dist/tasks-runners/*.d.ts",

527 "default": "./dist/tasks-runners/*.js"

528 }

529 },

530 "scripts": {

531 "postinstall": "node -e \"try{require('./dist/bin/post-install')}catch(e){}\""

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L531

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L531

532 }

533}

dist/bin/nx.jsView file

Lines 1-38javascript

1#!/usr/bin/env node

2"use strict";

3// TODO: Remove this workaround once picocolors handles FORCE_COLOR=0 correctly

4// See: https://github.com/alexeyraspopov/picocolors/issues/100

5Object.defineProperty(exports, "__esModule", { value: true });

6const tslib_1 = require

dist/src/utils/git-utils.index-filter.jsView file

Lines 1-24javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3/**

4 * This is meant to be used with `git filter-branch --index-filter` to rewrite

5 * history such that only commits related to the subdirectory is kept.

6 *

7 * Example:

dist/src/core/graph/runtime.jsView file

Lines 1-1javascript

1(()=>{"use strict";var e,r={},t={};function n(e){var o=t[e];if(void 0!==o)return

dist/bin/nx-cloud.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2"use strict";

3Object.defineProperty(exports, "__esModule", { value: true });

4exports.invokeCommandWithNxCloudClient = invokeCommandWithNxCloudClient;

5const get_cloud_options_1 =

dist/src/utils/git-utils.jsView file

Lines 1-33javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.GitRepository = void 0;

4exports.cloneFromUpstream = cloneFromUpstream;

dist/src/command-line/completion/scripts.jsView file

Lines 1-27javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.SHELLS = void 0;

4exports.printCompletionScript =

dist/src/utils/ab-testing.jsView file

116catch (e) { L117: if (process.env.NX_VERBOSE_LOGGING === 'true') { L118: console.error(e); ... L125: // Fallback on true as Package management doesn't support reading config for registry. L126: // currently Bun doesn't support fetching config settings https://github.com/oven-sh/bun/issues/7140 L127: return true; ... L129: try { L130: const stdout = (0, node_child_process_1.execSync)(pmc.getRegistryUrl, { L131: encoding: 'utf-8',

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/utils/ab-testing.jsView on unpkg · L116

dist/src/native/nx.wasm32-wasi.wasmView file

•path = dist/src/native/nx.wasm32-wasi.wasm kind = wasm_module sizeBytes = 3995716 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/src/native/nx.wasm32-wasi.wasmView on unpkg

dist/src/command-line/completion/scripts/fish.fishView file

•path = dist/src/command-line/completion/scripts/fish.fish kind = build_helper sizeBytes = 1538 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/src/command-line/completion/scripts/fish.fishView on unpkg

dist/src/core/graph/main.jsView file

•path = dist/src/core/graph/main.js kind = oversized_source_file sizeBytes = 2934436 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/src/core/graph/main.jsView on unpkg

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "try{require('./dist/bin/post-install')}catch(e){}"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node -e "try{require('./dist/bin/post-install')}catch(e){}"

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/bin/nx.jsView file

18const strip_indents_1 = require("../src/utils/strip-indents"); L19: const child_process_1 = require("child_process"); L20: const module_1 = require("module");

High

Child Process

Package source references child process execution.

dist/bin/nx.jsView on unpkg · L18

nx@23.0.1: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

12 flagged

package.jsonView file

Lines 511-533json

511 "types": "./dist/release/*.d.ts",

512 "default": "./dist/release/*.js"

513 },

514 "./release/*.js": {

515 "@nx/nx-source": "./release/*.ts",

516 "types": "./dist/release/*.d.ts",

517 "default": "./dist/release/*.js"

518 },

519 "./tasks-runners/*": {

520 "@nx/nx-source": "./tasks-runners/*.ts",

521 "types": "./dist/tasks-runners/*.d.ts",

522 "default": "./dist/tasks-runners/*.js"

523 },

524 "./tasks-runners/*.js": {

525 "@nx/nx-source": "./tasks-runners/*.ts",

526 "types": "./dist/tasks-runners/*.d.ts",

527 "default": "./dist/tasks-runners/*.js"

528 }

529 },

530 "scripts": {

531 "postinstall": "node -e \"try{require('./dist/bin/post-install')}catch(e){}\""

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L531

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L531

532 }

533}

dist/bin/nx.jsView file

Lines 1-38javascript

1#!/usr/bin/env node

2"use strict";

3// TODO: Remove this workaround once picocolors handles FORCE_COLOR=0 correctly

4// See: https://github.com/alexeyraspopov/picocolors/issues/100

5Object.defineProperty(exports, "__esModule", { value: true });

6const tslib_1 = require

dist/src/utils/git-utils.index-filter.jsView file

Lines 1-24javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3/**

4 * This is meant to be used with `git filter-branch --index-filter` to rewrite

5 * history such that only commits related to the subdirectory is kept.

6 *

7 * Example:

dist/src/core/graph/runtime.jsView file

Lines 1-1javascript

1(()=>{"use strict";var e,r={},t={};function n(e){var o=t[e];if(void 0!==o)return

dist/bin/nx-cloud.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2"use strict";

3Object.defineProperty(exports, "__esModule", { value: true });

4exports.invokeCommandWithNxCloudClient = invokeCommandWithNxCloudClient;

5const get_cloud_options_1 =

dist/src/utils/git-utils.jsView file

Lines 1-33javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.GitRepository = void 0;

4exports.cloneFromUpstream = cloneFromUpstream;

dist/src/command-line/completion/scripts.jsView file

Lines 1-27javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.SHELLS = void 0;

4exports.printCompletionScript =

dist/src/utils/ab-testing.jsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/utils/ab-testing.jsView on unpkg · L116

dist/src/native/nx.wasm32-wasi.wasmView file

•path = dist/src/native/nx.wasm32-wasi.wasm kind = wasm_module sizeBytes = 3995716 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/src/native/nx.wasm32-wasi.wasmView on unpkg

dist/src/command-line/completion/scripts/fish.fishView file

•path = dist/src/command-line/completion/scripts/fish.fish kind = build_helper sizeBytes = 1538 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/src/command-line/completion/scripts/fish.fishView on unpkg

dist/src/core/graph/main.jsView file

•path = dist/src/core/graph/main.js kind = oversized_source_file sizeBytes = 2934436 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/src/core/graph/main.jsView on unpkg

nx@23.0.1

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code