The nx Breach

How did they breach nx to publish a malicious package ? It started with the nx team introducing a bash injection vulnerability in a new github workflow: - name : Create PR message file run : | mkdir -p /tmp cat > /tmp/pr-message.txt << 'EOF' ${{ github.event.pull_request.title }} ${{ github.event.pull_request.body }} EOF Both ${{ github.event.pull_request.title }} and ${{…