VYPR
← All malware advisories

npm · Malicious package advisory

Malware

@nx/enterprise-cloud

MAL-2025-41437

Malicious code in @nx/enterprise-cloud (npm)

Details


---
_-= Per source details. Do not edit below this line.=-_

## Source: google-open-source-security (a8a1b6e74c68b5c6901f2ea242469aa5a34ffec9ddc3fb92267b3d1627123267)
The nx project and associated plugins were compromised via a vulnerable
GitHub workflow that allowed code injection and the theft of an NPM token.

Compromised versions (1)

  • 3.2.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.