{"answers":{"affected":"1 open source package ship an affected version, including @nx/js.","exploited":"There is no known exploitation of MAL-2025-41439 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2025-41439 is a malicious package in @nx/js, published on 27 Aug 2025."},"fix_prompt":"MAL-2025-41439 is a malicious package: @nx/js (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2025-41439/ (Markdown: https://insights.sbomify.com/MAL-2025-41439/index.md)","id":"MAL-2025-41439","markdown":"https://insights.sbomify.com/MAL-2025-41439/index.md","name":"MAL-2025-41439","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"## Summary\n\nMalicious versions of the [`nx` package](https://www.npmjs.com/package/nx), as well as some supporting plugin packages, were published to npm, containing code that scans the file system, collects credentials, and posts them to GitHub as a repo under user's accounts.\n\n## Immediate Actions Required\n\n### For all users, check if you were impacted\n\n1. Check your account's audit logs (https://github.com/settings/security-log?q=action%3Arepo.create) to see if a repo containing s1ngularity-repository in the name was published to your Github account. If so your credentials were likely compromised. Unfortunately, Github may have proactively deleted the repo for you. To be safe, rotate any credentials such as Github, NPM, and anything that may have been in your environment variables.\n2. Check your local machine to see if there is a file at `/tmp/inventory.txt`, this file will contain a list of files which the malware probably read from. If this file exists, you have been affected.\n3. Check this https://github.com/[GithubSlug]?tab=repositories\u0026q=s1ngularity-repository to see if you have a repo containing s1ngularity-repository remains on your Github account. If you do not have the repository available to you anymore, reach out to Github support and they can provide you the contents of the repository.\n4. Download the file in the repo for your own records.\n5. Then, remove the repo from GitHub.\n6. E-mail security@nrwl.io and we will instruct you on how to decode the file so you are aware what information was leaked\n7. Rotate your credentials and tokens on all of your accounts.\n\n#### Rotate your Github token\n\nIn order to rotate your Github token, follow these steps:\n\n1. Visit https://github.com/settings/connections/applications/178c6fc778ccc68e1d6a. This is the setting for the Github app used by the `gh` CLI to authenticate itself.\n2. Revoke access to that app. This will invalidate the OLD token which may have been compromised.\n3. The next time you run the `gh` CLI, you will reauth and a NEW token will be generated.\n\n**If you do not do this**, your Github access token may be utilized to do malicious activity on your Github account.\n\nRotate all of your tokens but this is specific instruction for Github to make it as easy as possible.\n\n### For all users, stop using the malicious versions\n\n```bash\n# Check if the version of nx you are using was a malicious version\nnpm ls nx\n\n# If using affected versions, update immediately:\nnpm uninstall nx \u0026\u0026 npm install nx@latest\n\n# Clear caches for any package manager\nyarn cache clean --all \npnpm store prune --force \nnpm cache clean --force\n\n# Remove cache directories\n\n# Windows\n%LocalAppData%/npm-cache/_npx \n\n# Unix\n~/.npm/_npx\n\n# Outputs of\nyarn cache dir\npnpm store path\n```\n\n### For Users Who were compromised:\n\nRefer to the section above to see if you were compromised. If so, do the following.\n\n- **Rotate npm tokens:** Visit https://www.npmjs.com/ and rotate your tokens.\n- **Rotate Github Tokens:** Visit https://www.github.com/ and rotate your tokens.\n- **Change Github Credentials:** Change passwords for Github\n- **Change your passwords** for any other services you use.\n- **Check your `.zshrc` and `.bashrc` files** for any unfamiliar lines and remove them.\n\n### Purge Malicious Versions from Internal Registries\n\nFor maintainers of internal registries Immediately remove the compromised versions listed above from your internal package registries (e.g., JFrog Artifactory, Sonatype Nexus) or any other proxies to `[npmjs.org](http://npmjs.org/)`. This will prevent further internal downloads of the malicious code. \n\n## Affected Versions of `nx`\n\n- 21.5.0\n  - Published at 6:32 PM\n- 20.9.0\n- 20.10.0\n- 21.6.0\n- 20.11.0\n- 21.7.0\n- 21.8.0\n- 20.12.0\n  - Published at 8:37 PM\n  \nThese versions have since been removed from NPM as of 10:44 PM EDT\n\n## Affected Versions of `@nx/devkit`, `@nx/js`, `@nx/workspace`, `@nx/node`\n\n- 21.5.0\n  - Published at 6:32 PM\n- 20.9.0\n  - Published at 8:42 PM\n\n## Affected Versions of `@nx/eslint`\n\n- 21.5.0\n  - Published at 6:32 PM\n\nThese versions have since been removed from NPM as of 10:44 PM EDT\n\n## Affected Versions of `@nx/key` and `@nx/enterprise-cloud`\n\n- 3.2.0 only\n  - Published at 6:32 PM\n  \nThese versions have since been removed from NPM as of 6:20 AM EDT\n\n## Attack Vector\n\n### Vulnerable Workflow\n\nThe root cause the introduction of a vulnerable [workflow](https://github.com/nrwl/nx/pull/32458) which contained the possibility for injecting executable code. The vulnerable workflow was reverted in `master` almost immediately after the team learned it could have been malicious. However, this proved to be inadequate to address the vulnerability.\n\nThe workflow contained the 2 issues.\n\n#### Bash Injection\n```yaml\n      - name: Validate PR title\n        run: |\n          echo \"Validating PR title: ${{ github.event.pull_request.title }}\"\n```\n\nThe intention of these lines was to print out the pull request titles being validated via our commit format checks.\n\nHowever, if a PR was opened with a title such as `$(echo \"You've been compromised\")` the code would be executed within the workflow. We understood this once it was reported but we did not fully understand how this would compromise any secrets because the PR title validation workflow itself did not have access to any secrets. \n\n#### Elevated Permissions via `pull_request_target`\n\n```yaml\non:\n  pull_request_target:\n    types: [opened, edited, synchronize, reopened]\n```\n\nThe `pull_request_target` trigger ([Github Docs](https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#pull_request_target)) was used as a way to trigger the action to run whenever a PR was created or modified. However, what was missed is the warning that this trigger, unlike the standard `pull_request` trigger, runs workflows with elevated permissions including a `GITHUB_TOKEN` which has read/write repository permission. Furthermore, the workflows are executed on the target repo of the PR (`nrwl/nx`) which means that the `GITHUB_TOKEN` had permissions for the `nrwl/nx` repo. In addition, the workflow is run using the version of the workflow available on the target branch which is not necessarily `master`. We believe that the PR was made targeting an outdated branch which still contained the vulnerable workflow despite the fact that the vulnerable workflow was removed from `master`.\n\n\u003e Note: While the `GITHUB_TOKEN` had read/write capabilities. The `master` branch and other important branches have Branch Protection rules enabled so the vulnerable workflow could not have written directly to `master`.\n\nWe believe the `GITHUB_TOKEN` from this workflow was utilized to trigger another workflow, the `publish.yml` workflow. \n\n### How the NPM token was compromised\n\nUp until this point, the team believed that although the PR validation workflow was vulnerable, it didn't contain any secrets. The vulnerable pipeline was just a means to trigger our `publish.yml` pipeline which does indeed have the npm token which was used to publish the malicious versions of Nx.\n\nThe `publish.yml` pipeline, is our most permissive pipeline. It is responsible for publishing the Nx packages and therefore has access to the npm token via a Github Secret. As such, we took great care at least within the pipeline itself that ONLY our team was able to utilize the pipeline. As recommended, our github secrets are only accessible within pipelines triggered on `nrwl/nx` and they are not accessible from any forks keeping it safe from external contributors.\n\nHowever, because of the elevated permissions from the PR validation workflow, the `publish.yml` workflow was triggered to run on the `nrwl/nx` repo. Additional changes were made in the [malicious commit](https://github.com/nrwl/nx/commit/3905475cfd0e0ea670e20c6a9eaeb768169dc33d) whic","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in @nx/js (npm)","id":"MAL-2025-41439","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2025"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"@nx/js","purl":"pkg:npm/%40nx/js","source":"MAL-2025-41439"}],"products":null,"published":"2025-08-27","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2025-41439/"}