VYPR
← All malware advisories

npm · Malicious package advisory

Malware

@nx/eslint

MAL-2025-41438

Malicious code in @nx/eslint (npm)

Details


---
_-= Per source details. Do not edit below this line.=-_

## Source: google-open-source-security (28938ac9b6855425f3f452af308a0335a4dc5eb1c23ba08865c5cc5be914783e)
The nx project and associated plugins were compromised via a vulnerable
GitHub workflow that allowed code injection and the theft of an NPM token.

Compromised versions (1)

  • 21.5.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.