Affected: nx, nx/devkit, nx/enterprise-cloud, nx/eslint, nx/js, nx/key, nx/node, nx/workspace, Red Hat Multicluster Global Hub, Red Hat OpenShift Serverless and 2 more

Malicious code was inserted into the Nx (build system) package and several related plugins. The tampered package was published to the npm software registry, via a supply-chain attack. Affected versions contain code that scans the file system, collects credentials, and posts them to GitHub as a repo under user's accounts.