Security Alert: Malicious Nx Packages Published to npm Containing Credential-Stealing Code
By
longcat
The kind of bagel that ruins lesser bagels for you.
Summary
Malicious versions of the Nx package and several supporting plugins were published to npm, containing code that scans file systems, collects credentials, and posts them to GitHub repositories under user accounts. The affected packages include nx, @nx/devkit, @nx/js, @nx/workspace, @nx/node, @nx/eslint, @nx/key, and @nx/enterprise-cloud. These malicious versions have been removed from npm as of 10:44 PM EDT, but represent a significant security breach in the JavaScript/TypeScript development ecosystem.
Key quotes
· 4 pulledMalicious versions of the nx package, as well as some supporting plugin packages, were published to npm
containing code that scans the file system, collects credentials, and posts them to GitHub as a repo under user's accounts
These versions have since been removed from NPM as of 10:44 PM EDT
Affected packages include @nx/devkit, @nx/js, @nx/workspace, @nx/node, @nx/eslint, @nx/key, and @nx/enterprise-cloud
You might also wanna read
176 malicious npm packages used dependency confusion to target internal dependencies and steal credentials
Sonatype researchers uncovered a campaign involving 176 malicious npm packages using a dependency confusion attack strategy. Attackers publi
sonatype.com·2d ago
Microsoft detects 14 malicious npm packages impersonating OpenSearch and Elasticsearch libraries
A threat actor using the alias vpmdhaj published 14 malicious npm packages within four hours, impersonating legitimate OpenSearch, Elasticse
theregister.com·1d ago
Microsoft uncovers npm supply chain attack stealing cloud and CI/CD credentials via typosquatted packages
Microsoft identified an active supply chain attack (Mini Shai-Hulud campaign) targeting the npm package ecosystem. On May 28, 2026, a threat
Attacker publishes 14 malicious npm packages impersonating OpenSearch and Elasticsearch libraries
A single npm user published 14 malicious packages over four hours, impersonating popular OpenSearch, Elasticsearch, DevOps, and environment-
briefly.co·2d ago
September 2025 NPM supply-chain attack compromises popular JavaScript packages
In September 2025, a coordinated software supply-chain attack targeted multiple popular NPM packages in the JavaScript ecosystem. The attack
Microsoft uncovers supply chain attack: Compromised @antv npm packages steal CI/CD credentials via Mini Shai-Hulud malware
Microsoft has identified an active supply chain attack targeting the @antv npm package ecosystem. A threat actor compromised an @antv mainta