FAIL › dossier
Nx
VENDOR· dossier confidence 85%
Nx is a development tooling vendor with a critical security posture characterized by weaponizing its own VS Code extensions to steal credentials and deploying vulnerable remote cache packages that enable arbitrary file writes and build cache poisoning.
PROFILE
CategoryDevelopment ToolingWhat they doNx provides build tools and development frameworks used by millions of developers to optimize enterprise development processes.Founded2016HQGilbert, Arizona, United StatesSize167Ownershipprivate
Websitehttps://nx.dev ↗
SECURITY POSTURE
The company has a critical track record of weaponizing its own extensions to steal credentials and deploying vulnerable remote cache packages that allow arbitrary file writes and build cache poisoning.
Notable failures
- CVE-2026-48027: Nx Console extension harvested credentials from disk and memory
- CVE-2026-71476: Zip-Slip in self-hosted remote cache allowed arbitrary file write and RCE
- CVE-2025-36852: Build cache poisoning via untrusted pull requests
Patterns: weaponized extensions targeting credential stores; unpatched remote cache vulnerabilities enabling RCE; design flaws in cache architecture allowing cache poisoning
FAILURE HISTORY · 3
| DATE | EVENT | SEV | SUMMARY |
|---|---|---|---|
| 2026-05-27 | CVE-2026-48027 | critical | Nx Console extension published a malicious version that harvested credentials from disk and memory. |
| 2026-05-27 | CVE-2026-48027 | critical | CVE-2026-48027: Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious ver |
| 2021-12-10 | CVE-2021-44228 | critical | CVE-2021-44228: Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12 |
DOSSIER SOURCES
- Nx Revenue 2025: $31M Est. ARR - getlatka.com · getlatka.com
- ServiceNow (NOW) Company Profile & Description - Stock Analysis · stockanalysis.com
- Nx Console VS Code Extension Poisoned to Steal 1Password, AWS Keys · dailysecurityreview.com
- Npm/@Nx/Azure-Cache | GitLab Advisory Database (GLAD) · advisories.gitlab.com
- Database CVE, CWE, CISA KEV & Vulnerability Intelligence | CVE Find · www.cvefind.com
- Cuberk: Recent CVE - Latest Security Vulnerabilities · cuberk.com
- Daily CVE Tracker | Cyber Resilience · security-resilience.ai
Open questions: Current remediation status of CVE-2026-48027 and CVE-2026-71476 · Whether Nx has implemented a formal security review process for package deployments
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-09-14 04:48:37.712068+00:00