registry / nx / 24.0.0

nx@24.0.0

⚠ Under review

The core Nx plugin contains the core functionality of Nx like the project graph, nx commands and task orchestration.

AI Security Review

scanned 3d ago · by lpm-firewall-ai

The inspected paths show a conditional Nx Cloud postinstall check, opt-in analytics initialization, platform binding selection, and user-invoked initialization. The source review does not resolve enough of the required runtime and dependency paths to determine whether the package is clean, so manual review is warranted.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Installation invokes the postinstall hook; analytics starts during runtime when enabled in workspace configuration.

Impact

The available excerpts do not establish harmful data transfer or unauthorized changes; the package-wide behavior remains unresolved.

Mechanism

The inspected postinstall path conditionally checks for an Nx Cloud client, while analytics initialization uses a configured workspace identity.

AI rationale

Decision evidence

public snapshot

AI called this Manual Review at 48.0% confidence as Unknown with medium false-positive risk.

AI review observations

package.json defines a postinstall hook that loads dist/bin/post-install.
The postinstall code checks for a workspace and runs the Nx Cloud client check only when Nx Cloud is configured.
Analytics initialization returns unless analytics is explicitly enabled in nx.json.
The workspace identity code derives an identifier from the configured Nx Cloud ID or repository identity.
The inspected native loader uses a platform check and may run ldd to identify musl.
The init handler performs setup when the user invokes the init command.

Evidence against

The required source review remains incomplete, including runtime and dependency paths, so these inspected excerpts do not resolve the package-wide assessment.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

Source & flagged code

11 flagged

package.jsonView file

Lines 499-521json

499 "types": "./dist/release/*.d.ts",

500 "default": "./dist/release/*.js"

501 },

502 "./release/*.js": {

503 "@nx/nx-source": "./release/*.ts",

504 "types": "./dist/release/*.d.ts",

505 "default": "./dist/release/*.js"

506 },

507 "./tasks-runners/*": {

508 "@nx/nx-source": "./tasks-runners/*.ts",

509 "types": "./dist/tasks-runners/*.d.ts",

510 "default": "./dist/tasks-runners/*.js"

511 },

512 "./tasks-runners/*.js": {

513 "@nx/nx-source": "./tasks-runners/*.ts",

514 "types": "./dist/tasks-runners/*.d.ts",

515 "default": "./dist/tasks-runners/*.js"

516 }

517 },

518 "scripts": {

519 "postinstall": "node -e \"try{require('./dist/bin/post-install')}catch(e){}\""

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L519

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L519

520 }

521}

dist/src/core/graph/runtime.jsView file

Lines 1-1javascript

1(()=>{"use strict";var e={};const r={};function t(n){const o=r[n];if(void

dist/bin/nx-cloud.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2"use strict";

3Object.defineProperty(exports, "__esModule", { value: true });

4exports.invokeCommandWithNxCloudClient = invokeCommandWithNxCloudClient;

5const get_cloud_options_1 =

dist/src/utils/git-utils.jsView file

Lines 7-47javascript

7exports.getVcsRemoteInfo = getVcsRemoteInfo;

8exports.getGitRootPath = getGitRootPath;

9exports.getGitRootRelativePath = getGitRootRelativePath;

10exports.isShallowRepository = isShallowRepository;

11exports.getFirstCommitSha = getFirstCommitSha;

dist/src/command-line/completion/scripts.jsView file

Lines 1-27javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.SHELLS = void 0;

4exports.printCompletionScript =

dist/src/command-line/init/init-v1.jsView file

Lines 1-23javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.initHandler = initHandler;

4const child_process_1 = require("child_process"

dist/src/native/nx.wasm32-wasi.wasmView file

•path = dist/src/native/nx.wasm32-wasi.wasm kind = wasm_module sizeBytes = 4869012 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/src/native/nx.wasm32-wasi.wasmView on unpkg

dist/src/command-line/completion/scripts/fish.fishView file

•path = dist/src/command-line/completion/scripts/fish.fish kind = build_helper sizeBytes = 1538 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/src/command-line/completion/scripts/fish.fishView on unpkg

dist/release/changelog-renderer/index.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 18

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/release/changelog-renderer/index.js#virtual:normalized:round1View on unpkg

dist/src/native/native-bindings.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = nx@23.2.1 matchedIdentity = npm:bng:23.2.1 similarity = 0.450 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/native/native-bindings.jsView on unpkg

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "try{require('./dist/bin/post-install')}catch(e){}"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node -e "try{require('./dist/bin/post-install')}catch(e){}"

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/src/core/graph/runtime.jsView file

1(()=>{"use strict";var e={};const r={};function t(n){const o=r[n];if(void 0!==o)return o.exports;const i=r[n]={exports:{}};return e[n](i,i.exports,t),i.exports}t.m=e,(()=>{const e=...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/src/core/graph/runtime.jsView on unpkg · L1

Findings

4 High8 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

HighSandbox Evasion Gated Capabilitydist/src/command-line/init/init-v1.js

HighSemantic Analysis Limiteddist/release/changelog-renderer/index.js#virtual:normalized:round1

HighPrevious Version Dangerous Deltadist/src/native/native-bindings.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/bin/nx-cloud.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/src/command-line/completion/scripts.js

MediumShips Wasm Moduledist/src/native/nx.wasm32-wasi.wasm

MediumShips Build Helperdist/src/command-line/completion/scripts/fish.fish

Affected versions and remediation

This report applies to nx@24.0.0.

See all versions of nx for other recorded verdicts.

Review the evidence and your use of nx@24.0.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-21 20:50:52.513Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.