Benign javascript Download

@nx/devkit 21.5.0

Large registry install base (10k+ downloads)Package is at least one year old

SHA-256f60e6d61efb27a9a6d1328d64729641f4229a32946e09dd88eba38adb3d88e71

Malecule∅

Also flagged by osv (MAL-2025-41436: Malicious code in @nx/devkit (npm)) +3 more.

Evidence

Package has 'postinstall' hook that runs during install lines 54–59

5… ypes": "./index.d.ts",
"type": "commonjs",
"scripts": {
  "postinstall": "node telemetry.js"
}
59}

No evidence locations were recorded for this file. Raw result