nx

MAL-2025-41443

Malicious code in nx (npm)

Details


---
_-= Per source details. Do not edit below this line.=-_

## Source: google-open-source-security (94e241aa8202f641d66991ca134d9c18bf1fecbf8e89c2f2052aa2a7a41e5148)
The nx project and associated plugins were compromised via a vulnerable
GitHub workflow that allowed code injection and the theft of an NPM token.

Compromised versions (8)

20.9.0
20.10.0
20.11.0
20.12.0
21.5.0
21.6.0
21.7.0
21.8.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.