nx@23.1.0: Suspicious npm security report (Warn)

Loading npm security reports…

Source & flagged code

13 flagged

package.jsonView file

Lines 515-537json

515 "types": "./dist/release/*.d.ts",

516 "default": "./dist/release/*.js"

517 },

518 "./release/*.js": {

519 "@nx/nx-source": "./release/*.ts",

520 "types": "./dist/release/*.d.ts",

521 "default": "./dist/release/*.js"

522 },

523 "./tasks-runners/*": {

524 "@nx/nx-source": "./tasks-runners/*.ts",

525 "types": "./dist/tasks-runners/*.d.ts",

526 "default": "./dist/tasks-runners/*.js"

527 },

528 "./tasks-runners/*.js": {

529 "@nx/nx-source": "./tasks-runners/*.ts",

530 "types": "./dist/tasks-runners/*.d.ts",

531 "default": "./dist/tasks-runners/*.js"

532 }

533 },

534 "scripts": {

535 "postinstall": "node -e \"try{require('./dist/bin/post-install')}catch(e){}\""

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L535

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L535

536 }

537}

dist/bin/nx.jsView file

Lines 1-38javascript

1#!/usr/bin/env node

2"use strict";

3// TODO: Remove this workaround once picocolors handles FORCE_COLOR=0 correctly

4// See: https://github.com/alexeyraspopov/picocolors/issues/100

5Object.defineProperty(exports, "__esModule", { value: true });

6const tslib_1 = require

dist/src/utils/git-utils.index-filter.jsView file

Lines 1-24javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3/**

4 * This is meant to be used with `git filter-branch --index-filter` to rewrite

5 * history such that only commits related to the subdirectory is kept.

6 *

7 * Example:

dist/src/core/graph/runtime.jsView file

Lines 1-1javascript

1(()=>{"use strict";var e,r={},t={};function n(e){var o=t[e];if(void 0!==o)return

dist/bin/nx-cloud.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2"use strict";

3Object.defineProperty(exports, "__esModule", { value: true });

4exports.invokeCommandWithNxCloudClient = invokeCommandWithNxCloudClient;

5const get_cloud_options_1 =

dist/src/utils/git-utils.jsView file

Lines 1-33javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.GitRepository = void 0;

4exports.cloneFromUpstream = cloneFromUpstream;

dist/src/command-line/completion/scripts.jsView file

Lines 1-27javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.SHELLS = void 0;

4exports.printCompletionScript =

dist/src/utils/ab-testing.jsView file

116catch (e) { L117: if (process.env.NX_VERBOSE_LOGGING === 'true') { L118: console.error(e); ... L125: // Fallback on true as Package management doesn't support reading config for registry. L126: // currently Bun doesn't support fetching config settings https://github.com/oven-sh/bun/issues/7140 L127: return true; ... L129: try { L130: const stdout = (0, node_child_process_1.execSync)(pmc.getRegistryUrl, { L131: encoding: 'utf-8',

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/utils/ab-testing.jsView on unpkg · L116

dist/src/native/nx.wasm32-wasi.wasmView file

•path = dist/src/native/nx.wasm32-wasi.wasm kind = wasm_module sizeBytes = 4053496 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/src/native/nx.wasm32-wasi.wasmView on unpkg

dist/src/command-line/completion/scripts/fish.fishView file

•path = dist/src/command-line/completion/scripts/fish.fish kind = build_helper sizeBytes = 1538 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/src/command-line/completion/scripts/fish.fishView on unpkg

dist/src/core/graph/main.jsView file

•path = dist/src/core/graph/main.js kind = oversized_source_file sizeBytes = 2934421 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/src/core/graph/main.jsView on unpkg

dist/src/command-line/init/implementation/utils.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = nx@23.0.2 matchedIdentity = npm:bng:23.0.2 similarity = 0.933 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/command-line/init/implementation/utils.jsView on unpkg

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "try{require('./dist/bin/post-install')}catch(e){}"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node -e "try{require('./dist/bin/post-install')}catch(e){}"

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/bin/nx.jsView file

18const strip_indents_1 = require("../src/utils/strip-indents"); L19: const child_process_1 = require("child_process"); L20: const module_1 = require("module");

High

Child Process

Package source references child process execution.

dist/bin/nx.jsView on unpkg · L18

nx@23.1.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

13 flagged

package.jsonView file

Lines 515-537json

515 "types": "./dist/release/*.d.ts",

516 "default": "./dist/release/*.js"

517 },

518 "./release/*.js": {

519 "@nx/nx-source": "./release/*.ts",

520 "types": "./dist/release/*.d.ts",

521 "default": "./dist/release/*.js"

522 },

523 "./tasks-runners/*": {

524 "@nx/nx-source": "./tasks-runners/*.ts",

525 "types": "./dist/tasks-runners/*.d.ts",

526 "default": "./dist/tasks-runners/*.js"

527 },

528 "./tasks-runners/*.js": {

529 "@nx/nx-source": "./tasks-runners/*.ts",

530 "types": "./dist/tasks-runners/*.d.ts",

531 "default": "./dist/tasks-runners/*.js"

532 }

533 },

534 "scripts": {

535 "postinstall": "node -e \"try{require('./dist/bin/post-install')}catch(e){}\""

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L535

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L535

536 }

537}

dist/bin/nx.jsView file

Lines 1-38javascript

1#!/usr/bin/env node

2"use strict";

3// TODO: Remove this workaround once picocolors handles FORCE_COLOR=0 correctly

4// See: https://github.com/alexeyraspopov/picocolors/issues/100

5Object.defineProperty(exports, "__esModule", { value: true });

6const tslib_1 = require

dist/src/utils/git-utils.index-filter.jsView file

Lines 1-24javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3/**

4 * This is meant to be used with `git filter-branch --index-filter` to rewrite

5 * history such that only commits related to the subdirectory is kept.

6 *

7 * Example:

dist/src/core/graph/runtime.jsView file

Lines 1-1javascript

1(()=>{"use strict";var e,r={},t={};function n(e){var o=t[e];if(void 0!==o)return

dist/bin/nx-cloud.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2"use strict";

3Object.defineProperty(exports, "__esModule", { value: true });

4exports.invokeCommandWithNxCloudClient = invokeCommandWithNxCloudClient;

5const get_cloud_options_1 =

dist/src/utils/git-utils.jsView file

Lines 1-33javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.GitRepository = void 0;

4exports.cloneFromUpstream = cloneFromUpstream;

dist/src/command-line/completion/scripts.jsView file

Lines 1-27javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.SHELLS = void 0;

4exports.printCompletionScript =

dist/src/utils/ab-testing.jsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/utils/ab-testing.jsView on unpkg · L116

dist/src/native/nx.wasm32-wasi.wasmView file

•path = dist/src/native/nx.wasm32-wasi.wasm kind = wasm_module sizeBytes = 4053496 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/src/native/nx.wasm32-wasi.wasmView on unpkg

dist/src/command-line/completion/scripts/fish.fishView file

•path = dist/src/command-line/completion/scripts/fish.fish kind = build_helper sizeBytes = 1538 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/src/command-line/completion/scripts/fish.fishView on unpkg

dist/src/core/graph/main.jsView file

•path = dist/src/core/graph/main.js kind = oversized_source_file sizeBytes = 2934421 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/src/core/graph/main.jsView on unpkg

dist/src/command-line/init/implementation/utils.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/command-line/init/implementation/utils.jsView on unpkg

nx@23.1.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code