Critical Vulnerability in @nx/node: Code Injection and NPM Token Theft
Summary
MAL-2025-41441: Malicious code in @nx/node (npm). Affects @nx/node versions 20.9.0 – 21.5.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @nx/node package is part of the Nx framework, which is designed for building scalable applications with a focus on monorepo architecture. It provides tools for managing multiple projects within a single repository, enhancing developer productivity and collaboration. However, a recent vulnerability has been identified that compromises the security of this package, allowing malicious actors to exploit its GitHub workflow.
Vulnerability Detail
The vulnerability originated from a compromised GitHub workflow associated with the nx project, which allowed for code injection and the theft of an NPM token. This could lead to unauthorized access to sensitive data and the potential for further exploitation of the affected systems. The malicious package versions identified are 20.9.0 and 21.5.0, which were altered to include harmful code.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @nx/nodeIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the affected versions of the @nx/node package from your project and replace them with a secure alternative or an earlier version that is not compromised. This can be done by executing: npm uninstall @nx/node and then installing a safe version.
Conclusion
The vulnerability in the @nx/node package poses significant risks due to code injection and token theft. It is crucial for developers using this package to update to the latest version and to monitor their applications for vulnerabilities using tools like Vulert. By staying informed and proactive, you can protect your projects from potential threats.
See every vulnerability recorded for @nx/node →
FAQ
The vulnerability involves code injection and the theft of an NPM token due to a compromised GitHub workflow.
The affected versions are 20.9.0 and 21.5.0.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
You should update to the latest version of @nx/node by running 'npm install @nx/node@latest' in your terminal.
Implementing security best practices in your development workflow, such as regular dependency audits and using tools like Vulert, can help prevent future vulnerabilities.
