Have we not learned, yet? The number of points this submission has already earned says we have not.
People, do not trust security advisors who tell you to do such things, especially ones who also remove the original instructions entirely and replace them with instructions to run their tools instead.
The original security advisory is at https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7... and at no point does it tell you to run the compromised programs in order to determine whether they are compromised versions. Or to run semgrep for that matter.
Good callout. Evidence so far points to `nx --version` itself being safe because this was in a post-install script but we changed the rec in our post.
We took the versions in the Github security advisory and compiled it into a Semgrep rule which is MIT-licensed: https://semgrep.dev/c/r/oqUk5lJ/semgrep.ssc-mal-resp-2025-08.... Semgrep rules can be overkill for these use cases but it can be convenient to have a single command to check for all affected versions across multiple packages, especially for our users who already have Semgrep installed. That's basically what I did on all our internal repos.
We updated the blog post to note the Semgrep rule is MIT licensed. And you can run locally with Semgrep (which is LGPL: https://github.com/returntocorp/semgrep) if you curl it and run `semgrep --config=rule.yaml`
This Semgrep post describes a very different prompt from what Nx reported themselves, which suggests the attacker was "live-editing" their payload over multiple releases and intended to go further.
Still, why does the payload only upload the paths to files without their actual contents?
Why would they not have the full attack ready before publishing it? Was it really just meant as a data gathering operation, a proof of concept, or are they just a bit stupid?
With all due respect to subsistence farming, I would say that digital tech is already sufficiently "bootstrapped", such that even if the world's industrial base entirely collapses, and we don't have any more chips fabricated, the next century will still be about who can best utilize computers, scrounging up discarded phones and repurposing them to (re)automate farming, manufacturing and drone warfare. Even LLM-based AIs are already entrenched, and I'd expect people to be running ollama and aider/void on solar powered laptops in their tribe's half-destroyed buildings.
@dang Even though the blogpost has some helpful flavor, this GH issue seems much more direct and giving much more straightforward guidance for resolving the issue. Is it possible to change the link?
I'll put the two blog posts that people have been linking to in the top text there, so people can read them if they want.
* we'll re-up the post so that it goes to roughly the same place on the frontpage that this submission was at before merging. that relativizes the timestamp (here: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...), but I believe longcat's submission was first.
Sorry neuroo - I know it sucks to have a post doing well on HN's frontpage and them plummet. But users are disagreeing about which URL is best so it seems safest to pick the original/official source, and to give the 'credit' to the first submitter.
17 comments
[ 2.5 ms ] story [ 47.0 ms ] thread> Run semgrep --config [...]
> Alternatively, you can run nx –version [...]
Have we not learned, yet? The number of points this submission has already earned says we have not.
People, do not trust security advisors who tell you to do such things, especially ones who also remove the original instructions entirely and replace them with instructions to run their tools instead.
The original security advisory is at https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7... and at no point does it tell you to run the compromised programs in order to determine whether they are compromised versions. Or to run semgrep for that matter.
Good callout. Evidence so far points to `nx --version` itself being safe because this was in a post-install script but we changed the rec in our post.
We took the versions in the Github security advisory and compiled it into a Semgrep rule which is MIT-licensed: https://semgrep.dev/c/r/oqUk5lJ/semgrep.ssc-mal-resp-2025-08.... Semgrep rules can be overkill for these use cases but it can be convenient to have a single command to check for all affected versions across multiple packages, especially for our users who already have Semgrep installed. That's basically what I did on all our internal repos.
We updated the blog post to note the Semgrep rule is MIT licensed. And you can run locally with Semgrep (which is LGPL: https://github.com/returntocorp/semgrep) if you curl it and run `semgrep --config=rule.yaml`
Still, why does the payload only upload the paths to files without their actual contents?
Why would they not have the full attack ready before publishing it? Was it really just meant as a data gathering operation, a proof of concept, or are they just a bit stupid?
https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7...
https://semgrep.dev/solutions/secure-vibe-coding/
if software development is turning into their demo:
then I'm switching careers to subsistence farming and waiting for the collapse* https://news.ycombinator.com/item?id=45040126
* https://news.ycombinator.com/item?id=45040507
I found the first submission on the story (https://news.ycombinator.com/item?id=45034496), which used a github url, and merged the thread into it - more explanation at https://news.ycombinator.com/item?id=45042727.
I'll put the two blog posts that people have been linking to in the top text there, so people can read them if they want.
* we'll re-up the post so that it goes to roughly the same place on the frontpage that this submission was at before merging. that relativizes the timestamp (here: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...), but I believe longcat's submission was first.
Sorry neuroo - I know it sucks to have a post doing well on HN's frontpage and them plummet. But users are disagreeing about which URL is best so it seems safest to pick the original/official source, and to give the 'credit' to the first submitter.