npm nx @22.7.5
score
1.0
high
flagged
2026-06-15 15:51
amplifiers
co-occurring signal pairs that lift the final score
- typosquat + install_script_payload: typosquat shape with active payload or stub-rush surface (+0.15)
Signals fired
| signal | weight | rationale |
|---|---|---|
| content | ||
| install_script_payload | 1.0 | install/lifecycle script matches payload regex |
| topology | ||
| typosquat | 1.0 | lev=1 to watched 'nw' |
| dist_tag_anomaly | 0.5 | dist-tags.latest=22.7.5 but max published is 23.0.0-beta.0 |
| shared_repo_different_publisher | 0.9 | repo 'https://github.com/nrwl/nx.git' also claimed by 10 package(s) under different publishers: ['npm/@nx/nx-linux-arm64-musl', 'npm/@nx/detox', 'npm/@nx/react-native'] ... |
Prior profile (what it deviated from)
{
"had_install_script": true,
"maintainers": [
"jack-nrwl",
"meeroslav",
"nrwlowner",
"nrwl-jason",
"juristr",
"altan-nrwl",
"jameshenry",
"vsavkin"
],
"versions": 2580
}
Evidence (package doc at flag time)
{
"dependencies_count": 110,
"dist": {
"integrity": "sha512-zoxsJabb33jl1QYnalDn0bicryrEBgSzdKp90d7VGGv/jDgzKrcLg/hw2ZxeYiOjWPIT/o8QNT9G9vTs4dv3AQ==",
"tarball": "https://registry.npmjs.org/nx/-/nx-22.7.5.tgz",
"unpackedSize": 16021901
},
"dist-tags": {
"canary": "23.0.0-canary.20260615-71bbc70",
"latest": "22.7.5",
"next": "23.0.0-rc.3",
"previous": "21.6.11",
"pull-request": "23.0.0-pr.33655.96527d2"
},
"latest_version": "22.7.5",
"maintainers": [
{
"email": "jack@nrwl.io",
"name": "jack-nrwl"
},
{
"email": "missing.manual@gmail.com",
"name": "meeroslav"
},
{
"email": "victor@nrwl.io",
"name": "nrwlowner"
},
{
"email": "jason@nrwl.io",
"name": "nrwl-jason"
},
{
"email": "juri.strumpflohner@gmail.com",
"name": "juristr"
},
{
"email": "altan@nrwl.io",
"name": "altan-nrwl"
},
{
"email": "james@henry.sc",
"name": "jameshenry"
},
{
"email": "avix1000@gmail.com",
"name": "vsavkin"
}
],
"num_versions": 2581,
"repository": {
"directory": "packages/nx",
"type": "git",
"url": "https://github.com/nrwl/nx.git"
},
"scripts": {
"postinstall": "node -e \"try{require('./dist/bin/post-install')}catch(e){}\""
},
"signal_details": {
"_amplifiers": [
"typosquat + install_script_payload: typosquat shape with active payload or stub-rush surface (+0.15)"
],
"dist_tag_anomaly": "dist-tags.latest=22.7.5 but max published is 23.0.0-beta.0",
"install_script_payload": "install/lifecycle script matches payload regex",
"shared_repo_different_publisher": "repo 'https://github.com/nrwl/nx.git' also claimed by 10 package(s) under different publishers: ['npm/@nx/nx-linux-arm64-musl', 'npm/@nx/detox', 'npm/@nx/react-native'] ...",
"typosquat": "lev=1 to watched 'nw'"
},
"time": {
"created": "2011-08-08T05:06:23.816Z",
"modified": "2026-06-15T20:51:39.233Z"
}
}