Malicious code was inserted into the Nx (build system) package and several related plugins. The tampered package was published to the npm software registry, via a supply-chain attack. Affected versions contain code that scans the file system, collects credentials, and posts them to GitHub as a repo under user's accounts.
Attackers published counterfeit versions of the Nx package and related plugins in the npm registry, replacing or overwriting legitimate versions. Malicious code embedded in the package scans the file system for credentials (such as API keys, tokens, passwords). Collected credentials are then sent to GitHub repositories created on victims' or attackers' accounts. The attack is executed automatically during installation or execution of the infected package.
Attackers can obtain access to credentials stored on workstations and development servers, which may lead to account takeover, further lateral movement in the infrastructure, and exposure of sensitive organizational resources.
Immediately verify whether affected versions of the Nx package and its plugins are installed in projects, then update to versions without malicious code according to the official security advisory available at https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c. You should also rotate all credentials (tokens, API keys, passwords) stored on machines where the package was installed. An audit of npm logs and verification of package integrity using lockfile mechanisms and checksums is recommended.
Nx package (build system) and related plugins published in the npm registry — specific version ranges indicated in the vendor references (advisory GHSA-cxm3-wv7p-598c).
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H