Security news · Malicious release · 27 August 2025

Malicious release of nx (20.9.0, 20.10.0, 20.11.0 …)

OSV.dev lists 8 releases of nx as malicious (MAL-2025-41443). The current release is not one of them.

What the advisory says

• MAL-2025-41443 lists version 20.9.0, 20.10.0, 20.11.0, 20.12.0, 21.5.0, 21.6.0, 21.7.0, 21.8.0 as containing malicious code.
• The release an agent would install today is not listed.

In the AptLynx catalogue

• nx

What to do

• If a computer installed or ran an affected version, treat it as compromised, as GitHub's advisories advise: from a different computer, change every password, key and token it held, then remove the package. Removing it alone may not remove what it installed.
• Before an agent installs a package, check it: check_tools over MCP at https://aptlynx.net/mcp, or https://aptlynx.net/v1/check?item=npm:<name>.

Sources

• MAL-2025-41443
• OSV.dev, the open vulnerability database (data from GitHub, OpenSSF and others)

Written automatically from published advisories and AptLynx's checks. If something here is wrong, tell us and we will correct it.