Jeff Cross

CEO of @nxdevtools. Self-proclaimed inventor of monorepos. Xoogler/Xangular

[Jeff Cross @jeffbcross]

@tuckner Done

[Jeff Cross @jeffbcross]

@victorsavkin Are you stepping down as leader of the Gray Party?

[Jeff Cross @jeffbcross]

Throwback to @samccone making a stink about fundamental flaws in npm 10 years ago (that are still not addressed):
https://t.co/CHH3Sg7VB4

[Victor Savkin @victorsavkin]

https://t.co/VUnNovPzJa

[Jeff Cross @jeffbcross]

@ayaladev @NxDevTools You should do the steps in the security advisory to be sure

[Jeff Cross @jeffbcross]

We’re continuing to work with Microsoft and GitHub to investigate the impact of the malicious Nx Console version 18.95.0. I'll share any updates on X (@jeffbcross and @NxDevTools) as well as in our security advisory: https://t.co/szBoQ3doaX.

Initially, Microsoft indicated to us that there were 28 installs of the malicious version 18.95.0. Based on our own analytics for the compromised version, we currently believe the number of users who received the malicious package may be significantly higher; potentially over 6k installs.

We’ll keep working to determine the actual impact and exposure, and I don’t want to speculate beyond the facts we have right now. But I also don’t want to minimize the situation.

This is my top priority right now. Our team has been, and continues to be focused on understanding exactly what happened, helping affected users, hardening our systems and release processes, and being as transparent as possible throughout the investigation.

[Jeff Cross @jeffbcross]

What you're seeing here isn't pigs desiring mudlessness; they just love getting sprayed by a hose.

Pigs like being clean, but don't care about superficial cleanliness. Pigs LOVE mud, they wallow in it and proudly walk around covered in mud the whole day. In fact, they need it to keep them cool and their skin protected in the sun.

Pics of my old pig, Cheddar, enjoying mud naps.

[老季 @XiaoJi0403]

猪其实是特别特别特别特别爱干净的动物，他们只是被关在猪圈没有条件天天洗澡

[Jeff Cross @jeffbcross]

@Aqeel_AT What makes it unaffordable? Pricing is designed for any team shape, ie large teams with frequent CI runs pay more (but still economical imo), but indie/small teams are often within our free threshold.

[Jeff Cross @jeffbcross]

Today we officially deprecated 4 packages that facilitated remote caching with Nx and different cloud providers: nx/s3-cache, nx/gcs-cache, nx/azure-cache
and nx/shared-fs-cache. This is a proactive move to discourage a known attack vector in recent supply chain attacks: cache poisoning.

This isn't related to Nx Cloud's remote caching which has built-in protection against poisoning. These plugins were used by teams who couldn't use Nx Cloud but wanted the speed benefits of distributed task caching.

We published a CVE (CREEP CVE-2025-36852) last year against these packages to make it clear that they shouldn't be used for serious projects because of the inherent design flaw. But we still see the plugins used in irresponsible ways.

Cyber attacks are ramping up, and are only going to get more effective as the tools the attackers use become more powerful. We're no longer compromising by providing tools that we know most users are using irresponsibly.

The notice linked in the next tweet gives more details and recommendations.

[Jeff Cross @jeffbcross]

The CREEP vulnerability: https://t.co/sFnePpz98h

[Jeff Cross @jeffbcross]

Full details:
https://t.co/gtwbV3zZ0h

[Nx @NxDevTools]

We've published the full, detailed postmortem of the Nx Console compromise from Monday May 18th: https://t.co/zIOvHn6J1M

[Victor Savkin @victorsavkin]

Difficult week, but the team showed up for it. Took full responsibility.

Long hours, canceled plans, paused vacations, to do right by the clients, the community, and also to handle this together.

Grateful for the team we have.

[Jeff Cross @jeffbcross]

@concept10 Number one for sure

[Jeff Cross @jeffbcross]

The hype is 100% justified, easily top 5 horror films of the past decade.

[DiscussingFilm @DiscussingFilm]

Curry Barker's ‘OBSESSION’ opens with $16M domestically.

The film had a budget of around $750K.

[Jeff Cross @jeffbcross]

@berenddeboer We're going to publish a postmortem tomorrow with full details, including what we did in response to s1ngularity last year, and how this occurred despite changes we made.

[Jeff Cross @jeffbcross]

GitHub’s report today confirms that the compromised Nx Console extension was used as the initial access vector in this attack.

This is a difficult thing to read as the CEO of Nx, and I want to be direct about it: we take responsibility for the role our software played in this incident.

I’m grateful to the GitHub, Microsoft, and independent security teams that moved quickly to investigate, contain, and share information publicly.

This incident highlights that there need to be deeper, more fundamental changes to how we and other maintainers need to think about securing developer tooling and open source distribution. We are already making major changes to our publishing, automation, and extension security posture, and we’ll continue sharing those changes publicly as we implement them.

We’re also beginning conversations with other high-profile open source maintainers about how we can work together on some of the deeper structural problems around software supply chain security. A lot of the assumptions the ecosystem has operated under for years no longer hold.

Our focus right now is supporting affected users, hardening Nx, and helping push the broader ecosystem toward stronger supply chain security practices.

Updates and guidance:
https://t.co/szBoQ3doaX

[Jeff Cross @jeffbcross]

@lcamtuf I author tweets and ask AI to optimize for clarity and brevity

[Jeff Cross @jeffbcross]

We published the detailed security advisory on GitHub and posted about it on X and Discord immediately after patching on Monday. I’m actually still waiting for confirmation from GitHub that Nx Console was the unnamed VSC extension in their postmortem, but I assume it is.

In hindsight, we should have been more skeptical of the 28 users number we got from MS, which made it seem like more of a contained situation. Our team is all hands on deck right now to help the Nx community check if they’re affected, and make sure they know steps to remediate.

[Jeff Cross @jeffbcross]

@tuckner We've asked, but haven't gotten official confirmation from GitHub yet that the extension in question was Nx Console. But seems likely.

[Jeff Cross @jeffbcross]

@dartilesm It's shocking how difficult it is for any maintainer to get detailed and timely information from npm/MS/GitHub when incidents like this occur.