nx

You don't need post-install scripts for this. Use optionalDependencies instead https://github.com/nrwl/nx/blob/master/packages/nx/package.j... Each of those deps contains a constraint installing only for the relevant platform.

The nx supply chain attack via npm was the bullet many companies did not doge. I mean, all you needed was to have the VS Code nx plugin installed — which always checked for the latest published nx version on npm. And if you had a local session with GitHub (eg logged into your company’s account via the GH CLI), or some important creds in a .env file… that was exfiltrated. This happened even if you had pinned dependencies and were on top of security updates. We need some deeper changes in the ecosystem. https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7...

>This is why I continue to insist there needs to be building codes for software, with inspections and fines for not following through. This attack could have been used on tens of thousands of institutions to bring down finance, power, telecommunications, hospitals, military, etc. And the scope of the attacks and their impact will only increase with AI. Clearly we are not responsible enough to write software safely and securely. So we must have a building code that forces us to do it safely and securely. Yea, except taps on the glass https://github.com/nrwl/nx/blob/master/LICENSE THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE F

This Semgrep post describes a very different prompt from what Nx reported themselves, which suggests the attacker was "live-editing" their payload over multiple releases and intended to go further. Still, why does the payload only upload the paths to files without their actual contents? Why would they not have the full attack ready before publishing it? Was it really just meant as a data gathering operation, a proof of concept, or are they just a bit stupid? https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7...

> Are you using a compromised version of nx? > Run semgrep --config [...] > Alternatively, you can run nx –version [...] Have we not learned, yet? The number of points this submission has already earned says we have not. People, do not trust security advisors who tell you to do such things, especially ones who also remove the original instructions entirely and replace them with instructions to run their tools instead. The original security advisory is at https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7... and at no point does it tell you to run the compromised programs in order to determine whether they are compromised versions. Or to run semgrep for that matter.

https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7... https://www.stepsecurity.io/blog/supply-chain-security-alert...

See also: https://www.stepsecurity.io/blog/supply-chain-security-alert... https://semgrep.dev/blog/2025/security-alert-nx-compromised-...

that's not really correct. nx is from 2017: https://github.com/nrwl/nx/graphs/contributors . might even be longer because I think the company is nrwl. the nx.dev site is just what I'm pointing to, dunno what url it was before that. no idea if there was an elixir plugin for nx (easy enough to integrate https://www.youtube.com/watch?v=IRIXPTIKTmA&t=6s) but I'd have no hope of finding it now . it's totally not the worst thing that nx was also the name Valim chose (I have no investment in to tool or company myself), but it is bad for both projects.

Its about preventing unnecessary friction while its still entirely avoidable. Yes, naming things is hard but renaming things after the fact is _way_ harder. Nothing exists for Numerical Elixer right now, so now is the perfect time to make the change. I think the fact that a popular github repo (https://github.com/nrwl/nx), a domain (https://nx.dev/), and loads of blog posts and tutorials exist for the current NX is enough reason to pick something else. Just thinking off the top... how about NeX.

That's what tools like https://github.com/nrwl/nx try to facilitate. Mainly facilitating separating the code in boundaries like backend, frontend, and common libraries. I haven't really used nx myself :-p. But I would love to use something similar for other frameworks or languages.