registry / Remote code execution / nx / 23.2.1

nx@23.2.1

The core Nx plugin contains the core functionality of Nx like the project graph, nx commands and task orchestration.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The package contains a guarded postinstall remote-code update path and explicit AI-agent control-surface changes. Those capabilities warrant a warning, but inspected code does not show credential theft, stealthy persistence, or a malicious install chain.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Installing nx in an Nx Cloud-enabled workspace, or running nx configure-ai-agents.

Impact

A compromised Cloud response could supply loaded code; the explicit command changes AI-agent control settings in the workspace.

Mechanism

Conditional remote bundle loading and explicit agent-config mutation.

AI rationale

Evidence

package.jsondist/bin/post-install.jsdist/src/nx-cloud/update-manager.jsdist/src/ai/set-up-ai-agents/set-up-ai-agents.jsnode_modules/.cache/nx/cloud.claude/settings.json.mcp.jsonAGENTS.md.codex/config.toml

Network endpoints2

cloud.nx.appgithub.com/nrwl/nx-ai-agents-config

Decision evidence

public snapshot

AI called this Suspicious at 85.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The install hook conditionally downloads and loads an Nx Cloud client bundle.
The configured AI-agent command can modify agent configuration and enable an Nx plugin.
The migration command can install another nx release in a temporary directory.

Evidence against

The install hook runs only for the main Nx package in a workspace with nx.json and Nx Cloud enabled.
AI-agent changes require the explicit configure-ai-agents command and normally an interactive selection.
No secret harvesting, unrelated exfiltration, or reviewer-directed package text was found in inspected sources.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

Source & flagged code

14 flagged

package.jsonView file

Lines 525-547json

525 "types": "./dist/release/*.d.ts",

526 "default": "./dist/release/*.js"

527 },

528 "./release/*.js": {

529 "@nx/nx-source": "./release/*.ts",

530 "types": "./dist/release/*.d.ts",

531 "default": "./dist/release/*.js"

532 },

533 "./tasks-runners/*": {

534 "@nx/nx-source": "./tasks-runners/*.ts",

535 "types": "./dist/tasks-runners/*.d.ts",

536 "default": "./dist/tasks-runners/*.js"

537 },

538 "./tasks-runners/*.js": {

539 "@nx/nx-source": "./tasks-runners/*.ts",

540 "types": "./dist/tasks-runners/*.d.ts",

541 "default": "./dist/tasks-runners/*.js"

542 }

543 },

544 "scripts": {

545 "postinstall": "node -e \"try{require('./dist/bin/post-install')}catch(e){}\""

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L545

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L545

546 }

547}

dist/bin/nx.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

2"use strict";

3// TODO: Remove this workaround once picocolors handles FORCE_COLOR=0 correctly

4// See: https://github.com/alexeyraspopov/picocolors/issues/100

5Object.defineProperty(exports, "__esModule", { value: true });

6const tslib_1 = require

dist/src/utils/git-utils.index-filter.jsView file

Lines 1-24javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3/**

4 * This is meant to be used with `git filter-branch --index-filter` to rewrite

5 * history such that only commits related to the subdirectory is kept.

6 *

7 * Example:

dist/src/core/graph/runtime.jsView file

Lines 1-1javascript

1(()=>{"use strict";var e,r={},t={};function n(e){var o=t[e];if(void 0!==o)return

dist/bin/nx-cloud.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2"use strict";

3Object.defineProperty(exports, "__esModule", { value: true });

4exports.invokeCommandWithNxCloudClient = invokeCommandWithNxCloudClient;

5const get_cloud_options_1 =

dist/src/utils/git-utils.jsView file

Lines 4-44javascript

4exports.cloneFromUpstream = cloneFromUpstream;

5exports.parseVcsRemoteUrl = parseVcsRemoteUrl;

6exports.locateGitDir = locateGitDir;

7exports.getVcsRemoteInfo = getVcsRemoteInfo;

8exports.getGitRootPath = getGitRootPath;

dist/src/command-line/completion/scripts.jsView file

Lines 1-27javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.SHELLS = void 0;

4exports.printCompletionScript =

dist/src/utils/ab-testing.jsView file

116catch (e) { L117: if (process.env.NX_VERBOSE_LOGGING === 'true') { L118: console.error(e); ... L125: // Fallback on true as Package management doesn't support reading config for registry. L126: // currently Bun doesn't support fetching config settings https://github.com/oven-sh/bun/issues/7140 L127: return true; ... L129: try { L130: const stdout = (0, node_child_process_1.execSync)(pmc.getRegistryUrl, { L131: encoding: 'utf-8',

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/utils/ab-testing.jsView on unpkg · L116

dist/src/command-line/init/init-v1.jsView file

3exports.initHandler = initHandler; L4: const child_process_1 = require("child_process"); L5: const prompt_helpers_1 = require("../../utils/prompt-helpers"); ... L20: const args = process.argv.slice(3).join(' '); L21: const version = process.env.NX_VERSION ?? ((0, semver_1.prerelease)(versions_1.nxVersion) ? versions_1.nxVersion : 'latest'); L22: if (process.env.NX_VERSION) { ... L26: setupDotNxInstallation(version); L27: await (0, format_1.formatInitWrites)(process.cwd()); L28: } L29: else if ((0, fs_1.existsSync)('package.json')) { L30: const packageJson = (0, fileutils_1.readJsonFile)('package.json'); ... L34: (0, utils_1.printFinalMessage)({

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/src/command-line/init/init-v1.jsView on unpkg · L3

•matchType = previous_version_dangerous_delta matchedPackage = nx@23.1.3 matchedIdentity = npm:bng:23.1.3 similarity = 0.433 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/command-line/init/init-v1.jsView on unpkg

dist/src/native/nx.wasm32-wasi.wasmView file

•path = dist/src/native/nx.wasm32-wasi.wasm kind = wasm_module sizeBytes = 4061447 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/src/native/nx.wasm32-wasi.wasmView on unpkg

dist/src/command-line/completion/scripts/fish.fishView file

•path = dist/src/command-line/completion/scripts/fish.fish kind = build_helper sizeBytes = 1538 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/src/command-line/completion/scripts/fish.fishView on unpkg

dist/release/changelog-renderer/index.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 20

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/release/changelog-renderer/index.js#virtual:normalized:round1View on unpkg

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "try{require('./dist/bin/post-install')}catch(e){}"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node -e "try{require('./dist/bin/post-install')}catch(e){}"

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/bin/nx.jsView file

19const strip_indents_1 = require("../src/utils/strip-indents"); L20: const child_process_1 = require("child_process"); L21: const module_1 = require("module");

High

Child Process

Package source references child process execution.

dist/bin/nx.jsView on unpkg · L19

Findings

7 High8 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/bin/nx.js

HighShelldist/src/utils/git-utils.index-filter.js

HighSame File Env Network Executiondist/src/utils/ab-testing.js

HighSandbox Evasion Gated Capabilitydist/src/command-line/init/init-v1.js

HighSemantic Analysis Limiteddist/release/changelog-renderer/index.js#virtual:normalized:round1

HighPrevious Version Dangerous Deltadist/src/command-line/init/init-v1.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/bin/nx-cloud.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistence

Affected versions and remediation

This report applies to nx@23.2.1.

See all versions of nx for other recorded verdicts.

Review the evidence and your use of nx@23.2.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-12 18:26:51.951Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code