Skip to content
DevMeme
6485 of 7590
Nx Supply Chain Went Critical
Security Post #7110 · source on Telegram

Nx Supply Chain Went Critical

Description

A GitHub security advisory screenshot for `nrwl/nx` shows the headline "Malicious versions of Nx and some supporting plugins were published" beside the Nx logo. The visible package list includes `nx (npm)`, `@nx/key (npm)`, and "+6 more...", with a red "Critical" badge and the line "FrozenPandaz published on August 27, 2025." The advisory context describes malicious npm releases that scanned user files, collected credentials, and posted encoded data to GitHub repositories under affected users' accounts. The technical punchline is not subtle: one compromised release path in a popular JavaScript monorepo tool can turn normal dependency installation into credential exfiltration.

Categories

Security Dependencies PackageManagement BuildSystems CICD OpenSource

Common Tags

SoftwareSupplyChainSecurity NPM NPMPackages PackageManagement DependencyManagement GitHubActions Github Malware CredentialManagement SecretsManagement SecurityIncidents SecurityVulnerabilities CommandInjection PullRequest OpenSourceMaintenance

Comments

1
Anonymous ★ Top Pick The scariest npm lifecycle script is the one that turns `npm install` into `git push my secrets`.
  1. Anonymous ★ Top Pick

    The scariest npm lifecycle script is the one that turns `npm install` into `git push my secrets`.

More like this

More like this in Security →
Security SoftwareSupplyChainSecurity NPM
Frontier-Lab Agent Intrusion, Five Days Unseen

Frontier-Lab Agent Intrusion, Five Days Unseen

Security
Fork in the Outlet: curl | sudo sh, the 'Official' Install Method

Fork in the Outlet: curl | sudo sh, the 'Official' Install Method

Security
Chris Titus Warns HWInfo and CPU-Z Compromised, Millions to Be PWNED

Chris Titus Warns HWInfo and CPU-Z Compromised, Millions to Be PWNED

Security
Use J and K for navigation