nx@23.1.3: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

nx@23.1.3: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "try{require('./dist/bin/post-install')}catch(e){}"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node -e "try{require('./dist/bin/post-install')}catch(e){}"

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/bin/nx.jsView file

19const strip_indents_1 = require("../src/utils/strip-indents"); L20: const child_process_1 = require("child_process"); L21: const module_1 = require("module");

High

Child Process

Package source references child process execution.

dist/bin/nx.jsView on unpkg · L19

dist/src/utils/git-utils.index-filter.jsView file

11const { execSync } = require('child_process'); L12: // NOTE: Using env vars because Windows PowerShell has its own handling of quotes (") messes up quotes in args, even if escaped. L13: const src = process.env.NX_IMPORT_SOURCE;

High

Shell

Package source references shell execution.

dist/src/utils/git-utils.index-filter.jsView on unpkg · L11

dist/src/core/graph/runtime.jsView file

1(()=>{"use strict";var e,r={},t={};function n(e){var o=t[e];if(void 0!==o)return o.exports;var i=t[e]={exports:{}};return r[e](i,i.exports,n),i.exports}n.m=r,e=[],n.O=(r,t,o,i)=>{i...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/src/core/graph/runtime.jsView on unpkg · L1

dist/bin/nx-cloud.jsView file

4exports.invokeCommandWithNxCloudClient = invokeCommandWithNxCloudClient; L5: const get_cloud_options_1 = require("../src/nx-cloud/utilities/get-cloud-options"); L6: const update_manager_1 = require("../src/nx-cloud/update-manager");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/bin/nx-cloud.jsView on unpkg · L4

dist/src/utils/git-utils.jsView file

17const tslib_1 = require("tslib"); L18: const child_process_1 = require("child_process"); L19: const crypto = tslib_1.__importStar(require("crypto")); ... L24: return new Promise((res, rej) => { L25: (0, child_process_1.execFile)(file, args, { ...execOptions, windowsHide: true }, (err, stdout) => { L26: if (err) { ... L103: } L104: async fetch(remote, ref) { L105: return await this.execGit(['fetch', remote, ...(ref ? [ref] : [])]); ... L166: if (source !== '') { L167: const indexFilterCommand = `node ${quoteForShell((0, path_1.join)(__dirname, 'git-utils.index-filter.js'))}`; L168: await this.execGit([

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/src/utils/git-utils.jsView on unpkg · L17

dist/src/command-line/completion/scripts.jsView file

7exports.generateScript = generateScript; L8: const child_process_1 = require("child_process"); L9: const fs_1 = require("fs"); ... L12: exports.SHELLS = ['bash', 'zsh', 'fish', 'powershell']; L13: /** Print the raw wrapper script to stdout — for scripting / custom rc paths. */ L14: function printCompletionScript(shell) { L15: process.stdout.write(generateScript(shell)); L16: } ... L79: case 'bash': L80: return [(0, path_1.join)(home, '.bashrc')]; L81: case 'zsh': ... L97: function resolvePowerShellProfiles() {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/src/command-line/completion/scripts.jsView on unpkg · L7

dist/src/utils/ab-testing.jsView file

116catch (e) { L117: if (process.env.NX_VERBOSE_LOGGING === 'true') { L118: console.error(e); ... L125: // Fallback on true as Package management doesn't support reading config for registry. L126: // currently Bun doesn't support fetching config settings https://github.com/oven-sh/bun/issues/7140 L127: return true; ... L129: try { L130: const stdout = (0, node_child_process_1.execSync)(pmc.getRegistryUrl, { L131: encoding: 'utf-8',

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/utils/ab-testing.jsView on unpkg · L116

dist/src/native/nx.wasm32-wasi.wasmView file

•path = dist/src/native/nx.wasm32-wasi.wasm kind = wasm_module sizeBytes = 4061345 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/src/native/nx.wasm32-wasi.wasmView on unpkg

dist/src/command-line/completion/scripts/fish.fishView file

•path = dist/src/command-line/completion/scripts/fish.fish kind = build_helper sizeBytes = 1538 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/src/command-line/completion/scripts/fish.fishView on unpkg

dist/src/adapter/ngcli-adapter.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 18

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/src/adapter/ngcli-adapter.js#virtual:normalized:round1View on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 520-542json

520 "types": "./dist/release/*.d.ts",

521 "default": "./dist/release/*.js"

522 },

523 "./release/*.js": {

524 "@nx/nx-source": "./release/*.ts",

525 "types": "./dist/release/*.d.ts",

526 "default": "./dist/release/*.js"

527 },

528 "./tasks-runners/*": {

529 "@nx/nx-source": "./tasks-runners/*.ts",

530 "types": "./dist/tasks-runners/*.d.ts",

531 "default": "./dist/tasks-runners/*.js"

532 },

533 "./tasks-runners/*.js": {

534 "@nx/nx-source": "./tasks-runners/*.ts",

535 "types": "./dist/tasks-runners/*.d.ts",

536 "default": "./dist/tasks-runners/*.js"

537 }

538 },

539 "scripts": {

540 "postinstall": "node -e \"try{require('./dist/bin/post-install')}catch(e){}\""

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L540

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L540

541 }

542}

dist/bin/nx.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

2"use strict";

3// TODO: Remove this workaround once picocolors handles FORCE_COLOR=0 correctly

4// See: https://github.com/alexeyraspopov/picocolors/issues/100

5Object.defineProperty(exports, "__esModule", { value: true });

6const tslib_1 = require

dist/src/utils/git-utils.index-filter.jsView file

Lines 1-24javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3/**

4 * This is meant to be used with `git filter-branch --index-filter` to rewrite

5 * history such that only commits related to the subdirectory is kept.

6 *

7 * Example:

8

dist/src/core/graph/runtime.jsView file

Lines 1-1javascript

1(()=>{"use strict";var e,r={},t={};function n(e){var o=t[e];if(void 0!==o)return

dist/bin/nx-cloud.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2"use strict";

3Object.defineProperty(exports, "__esModule", { value: true });

4exports.invokeCommandWithNxCloudClient = invokeCommandWithNxCloudClient;

5const get_cloud_options_1 =

dist/src/utils/git-utils.jsView file

Lines 1-37javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.GitRepository = void 0;

4exports.cloneFromUpstream = cloneFromUpstream;

dist/src/command-line/completion/scripts.jsView file

Lines 1-27javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.SHELLS = void 0;

4exports.printCompletionScript =

dist/src/utils/ab-testing.jsView file

116catch (e) { L117: if (process.env.NX_VERBOSE_LOGGING === 'true') { L118: console.error(e); ... L125: // Fallback on true as Package management doesn't support reading config for registry. L126: // currently Bun doesn't support fetching config settings https://github.com/oven-sh/bun/issues/7140 L127: return true; ... L129: try { L130: const stdout = (0, node_child_process_1.execSync)(pmc.getRegistryUrl, { L131: encoding: 'utf-8',

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/utils/ab-testing.jsView on unpkg · L116

dist/src/native/nx.wasm32-wasi.wasmView file

•path = dist/src/native/nx.wasm32-wasi.wasm kind = wasm_module sizeBytes = 4061345 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/src/native/nx.wasm32-wasi.wasmView on unpkg

dist/src/command-line/completion/scripts/fish.fishView file

•path = dist/src/command-line/completion/scripts/fish.fish kind = build_helper sizeBytes = 1538 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/src/command-line/completion/scripts/fish.fishView on unpkg

dist/src/adapter/ngcli-adapter.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 18

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/src/adapter/ngcli-adapter.js#virtual:normalized:round1View on unpkg