The recently published NPM version (21.7.0) contains malware?

[TimShilov]

Current Behavior

I just saw an automated update PR created by Renovate in one of my repos containing update for nx to version 21.7.0.

The latest version on NPM is indeed 21.7.0 and it was published ~11 minutes ago.
However this version isn't present in GitHub releases.

Looking at the diff, it seems like it contains some kind of malware that gathers information about the system, checks for available CLIs and makes some GitHub requests? 😕

Expected Behavior

I expect this to be un-published.

GitHub Repo

No response

Steps to Reproduce

Just check the latest version on NPM.

Nx Report

Not relevant.

Failure Logs

Package Manager Version

No response

Operating System

• macOS
• Linux
• Windows
• Other (Please specify)

Additional Information

No response

[jahredhope]

Similar to: #32522

[hckhanh]

I fired a report to NPM about the security concern. Let them check it!

[jaysoo]

I'll close this one in favor of #32522.

The versions have been unpublished and we're taking action revoke the keys that were used to publish them.