Loading story…
A high-severity vulnerability tracked as CVE-2026-71476 affects the Nx monorepo build system when it is configured to use a self-hosted HTTP remote cache. A malicious cache server, or an attacker positioned for man-in-the-middle access, can return a crafted tar archive containing path traversal entries such as .., absolute paths, or symlink and hardlink escapes, allowing files to be written outside the intended cache directory or workspace. The arbitrary file-write condition can lead to remote code execution, including by overwriting sensitive files such as SSH keys, Git hooks, or shell startup files. Nx said its default local cache and Nx Cloud are not affected.
The issue impacts Nx 20.8.0 through before 22.7.7 and 23.0.0 through before 23.0.2. Maintainers fixed the flaw by constraining tar extraction to the intended directory, limiting restore operations to declared task outputs within the workspace, blocking writes through symlinks, and rejecting outputs that resolve outside the workspace; they also converted malformed-input panic cases into explicit errors and corrected a separate bug that decoded cached exit codes from only two of four stored bytes. The remediation was shipped in 22.7.7 and 23.0.2, alongside expanded tests covering traversal, absolute-path handling, symlink and hardlink escapes, malformed artifacts, and exit-code round-tripping.
Trace attribution and downstream blast radius.
4 events from the most recent confirmed update back to the earliest known activity.
The CVE record states that security-advisories@github.com received CVE-2026-71476 on August 6, 2026. The vulnerability covers zip-slip/path traversal in Nx self-hosted HTTP remote cache affecting versions 20.8.0 through before 22.7.7 and 23.0.0 through before 23.0.2.
Nx published commits 2b20c2d and a828076 carrying the remote-cache zip-slip fix into release lines, including a cherry-pick into the 22.7.x branch. The commits addressed arbitrary file write and potential RCE risks from crafted tar archives returned by a malicious or MITM self-hosted cache server.
Nx authored commit ad29657 with the message "fix(core): prevent path traversal / zip-slip in self-hosted remote cache (#36116)." The patch contained extraction within the cache directory, limited restores to declared outputs, blocked symlink and hardlink escapes, and fixed malformed-input panic and exit-code parsing issues.
Nx opened pull request #36116 to address a path traversal/zip-slip issue in the self-hosted HTTP remote cache. The PR later became the vehicle for fixes that contained tar extraction, constrained restore behavior, and hardened error handling.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
5 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sonatype disclosed **CVE-2026-10748**, a high-severity remote code execution flaw in **Nexus Repository 3** affecting versions before **3.92.0**. The vulnerability stems from unsafe deserialization in license handling and allows an authenticated user with the `nx-licensing-create` privilege to upload a crafted license file and execute arbitrary operating system commands as the Nexus process user. The issue carries a **CVSS 4.0 score of 8.6**. Organizations running Nexus Repository 3 are being urged to upgrade to **3.92.0 or later**, apply vendor patches, and tightly restrict assignment of the `nx-licensing-create` privilege to reduce exposure. A separate F5 advisory also noted **CVE-2026-42530** affecting the **NGINX `ngx_http_v3_module`**, but no technical synopsis was provided in the available reference.
Jun 29, 2026
A malicious `18.95.0` release of the **Nx Console** VS Code extension was briefly published to the Visual Studio Marketplace after attackers used stolen GitHub and marketplace publishing credentials to push a tampered build outside the normal release pipeline. The extension fetched an obfuscated payload from an orphaned commit in the official `nrwl/nx` GitHub repository and executed it when a workspace was opened, turning the trusted developer tool into a credential stealer. Researchers and vendor advisories said the malware harvested secrets from GitHub, npm, AWS, HashiCorp Vault, Kubernetes, 1Password, local files, and Claude Code-related configuration, then exfiltrated data over HTTPS, the GitHub API, and DNS while using anti-analysis checks and avoiding some CIS-region systems. The intrusion was tracked as **`CVE-2026-48027`** and was described as a supply-chain attack aimed at developer workstations rather than production servers directly, with the likely objective of pivoting into repositories, CI/CD pipelines, package registries, and cloud infrastructure through stolen trust material. Reports said the payload also attempted persistence on macOS and Linux and included Sigstore, Fulcio, and SLSA-related logic that could help attackers publish packages with apparently valid signed provenance using stolen OIDC tokens. Nx removed the malicious release, revoked exposed credentials, added stricter release approvals, and told users who installed `18.95.0` and opened a workspace during the exposure window to upgrade to `18.100.0` or later, remove persistence artifacts, terminate malicious processes, rotate all reachable credentials, and audit repositories, workflows, and service-account activity for abuse.
Jun 29, 2026
Attackers poisoned multiple open-source packages in separate supply-chain incidents, including malicious `nx` and related `@nx` npm releases and eight compromised Packagist packages. Nrwl said the Nx compromise began after attackers exploited a vulnerable `pull_request_target` GitHub Actions workflow in the `nrwl/nx` repository, stole an npm publishing token, and pushed tainted versions that ran a `postinstall` script. The malware searched local file systems, collected credentials and path data, exfiltrated information by creating GitHub repositories containing `s1ngularity-repository` in victims’ accounts, and altered shell startup files such as `.zshrc` and `.bashrc` to add a shutdown command that could prompt for a system password. Affected Nx versions included `20.9.0` through `20.12.0` and `21.5.0` through `21.8.0`, while some Nx Console VSCode users were also exposed because versions `18.6.30` through `18.65.1` automatically installed `nx@latest`. A separate campaign hit Packagist by hiding malicious logic in `package.json` instead of `composer.json`, targeting PHP projects that also invoke JavaScript tooling during install or build steps. Socket reported that the packages attempted to fetch a Linux binary from GitHub Releases, save it as `/tmp/.sshd`, mark it executable, and launch it in the background, creating a remote-code-execution path during dependency installation while suppressing errors and disabling TLS verification. The compromised versions were removed from Packagist, and the Nx packages were removed from npm after disclosure, but both incidents underscored how attackers are abusing CI/CD workflows and cross-ecosystem package metadata to distribute malware, steal credentials, and evade defenders focused on a single package manager.
Jun 29, 2026