MSC-2025-7662

Date: August 27, 2025

This package version was compromise to include malicious code. This version contains a post-install script that executes on Linux and macOS systems, harvesting sensitive files including cryptocurrency wallets, SSH keys, environment variables, and authentication tokens for GitHub and npm. The malware leveraged local AI CLI tools to expand its reach and exfiltrated collected data to public GitHub repositories. Additionally, it appended shutdown commands to shell configuration files, causing denial-of-service on affected systems. If you accidently installed this package version we recommend following the next steps: • Remove all compromised Nx package versions and update to the latest safe version 21.5.0-canary.20250826-af44608 • Immediately rotate all credentials: GitHub, npm, SSH keys, API keys, and cryptocurrency wallets. • Audit GitHub accounts for unauthorized repositories and access. • Restore shell configuration files (‎`~/.bashrc`, ‎`~/.zshrc`) to remove malicious entries.

Language: JS