← Home

@nx/conformance

A Nx plugin which allows users to write and apply rules for your entire workspace that help with consistency, maintainability, reliability and security.

8
Versions
Commercial
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures No source commit

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

nrwlownernrwl-jasonjack-nrwlmaxklessjameshenry

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance missing-githead AI (provenance): Published by GitHub Actions CI; gitHead absence is a minor CI config change, not a supply-chain indicator for this established package. ai
semgrep semgrep:obfuscation-while-true AI (semgrep): Intentional obfuscation in commercial Nx Powerpack binary for license enforcement; stable pattern across all versions. ai
phantom-deps phantom-dep:@nx/key AI (phantom-deps): Same-org license key dependency; used indirectly through the obfuscated binary. ai
phantom-deps phantom-dep:ajv AI (phantom-deps): Used indirectly via bundled/obfuscated code; stable false positive for this package. ai
phantom-deps phantom-dep:semver AI (phantom-deps): Used indirectly via bundled/obfuscated code; stable false positive for this package. ai
phantom-deps phantom-dep:esbuild AI (phantom-deps): Known implicit build/bundle dependency; stable false positive for this package. ai
semgrep semgrep:dynamic-require AI (semgrep): resolve-rule.js dynamically loads user-defined conformance rules; this is the core plugin-loader pattern for this package. ai
dependencies unvetted-dep:@nx/key AI (dependencies): @nx/key is an internal Nx licensing package; stable dependency for this commercial Nx plugin. ai

Versions (showing 8 of 8)

Version Deps Published
5.0.7 7 / 0
5.0.6 7 / 0
5.0.5 7 / 0
5.0.4 7 / 0
5.0.3 7 / 0
5.0.2 7 / 0
5.0.1 7 / 0
5.0.0 7 / 0

v5.0.7

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.0.6

2 findings
HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.0.5

2 findings
HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.0.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v5.0.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v5.0.2

22 findings
HIGH obfuscation-while-true: bin/conformance-check.js:2 semgrep

while(!![]) loop is a signature of javascript-obfuscator output 1 | #!/usr/bin/env node > 2 | 'use strict';const a0_0x265ddc=a0_0x49c8;(function(_0x5bcbba,_0x44a5e7){const _0x591da5=a0_0x49c8,_0x2a61c2=_0x5bcbba();

HIGH obfuscation-while-true: bin/conformance.js:2 semgrep

while(!![]) loop is a signature of javascript-obfuscator output 1 | #!/usr/bin/env node > 2 | 'use strict';function a1_0x530e(){const _0x24460d=['../src/commands/conformance/command-object','2825346HgJrbB','command

HIGH obfuscation-while-true: src/commands/conformance/command-object.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';const a2_0x2aab76=a2_0x58a1;function a2_0x58a1(_0x235cb7,_0x1cde6b){const _0x13d52a=a2_0x13d5();return a2_0

HIGH obfuscation-while-true: src/commands/conformance/conformance.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';const a3_0x1c7231=a3_0xb234;function a3_0x35f6(){const _0x33d6db=['FeaturePermission','The\x20\x22rule.stat

HIGH obfuscation-while-true: src/conformance-tree.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';const a4_0x3d9b3e=a4_0x596a;function a4_0x25cd(){const _0x4ca7d1=['529302kASuDM','delete','tree.delete','Fs

HIGH obfuscation-while-true: src/executors/bundle-rules/executor.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';const a5_0x13b66b=a5_0x16a0;(function(_0x1d1339,_0x5088b2){const _0x360238=a5_0x16a0,_0x15a4e6=_0x1d1339();

HIGH obfuscation-while-true: src/generators/create-rule/create-rule.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';function a6_0x562c(_0x398a18,_0x95795a){const _0x27766d=a6_0x2776();return a6_0x562c=function(_0x562c94,_0x

HIGH obfuscation-while-true: src/generators/preset/preset.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';const a7_0x37bec8=a7_0x3314;(function(_0x3bf097,_0x56403d){const _0x6aca9f=a7_0x3314,_0xac2a11=_0x3bf097();

HIGH obfuscation-while-true: src/index.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';var a8_0x1f94dd=a8_0x4c83;(function(_0x5aa023,_0x2291c0){var _0x5a998d=a8_0x4c83,_0x416742=_0x5aa023();whil

HIGH obfuscation-while-true: src/resolve-rule.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';const a9_0x405dd5=a9_0x387b;function a9_0xc181(){const _0x458212=['Failed\x20to\x20read\x20schema.json\x20f

HIGH obfuscation-while-true: src/rules-runner-obfuscated.bench.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';const a12_0x4f420d=a12_0x3370;function a12_0x522b(){const _0x151e06=['270ecOWYP','push','bench','/nx.json',

HIGH obfuscation-while-true: src/rules-runner.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';const a13_0x185808=a13_0x3b2a;(function(_0x1184be,_0x20f786){const _0x4a7057=a13_0x3b2a,_0x28ed93=_0x1184be

HIGH obfuscation-while-true: src/rules/enforce-project-boundaries/index.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';const a10_0xdf6119=a10_0x1daa;function a10_0x130d(){const _0x438fdd=['5oZKotq','forEach','source','nodes','

HIGH obfuscation-while-true: src/rules/ensure-owners/index.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';function a11_0x20d0(){const _0x4a6e13=['527579tWhgDe','length','4532RmQTpP','metadata','nodes','projectGrap

HIGH obfuscation-while-true: src/terminal-reporter.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';const a14_0x42b692=a14_0x213f;(function(_0x3272da,_0x35e287){const _0x13fbfa=a14_0x213f,_0x506adc=_0x3272da

HIGH obfuscation-while-true: src/types.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';var a15_0xcba0ad=a15_0x226c;function a15_0xe94b(){var _0x951609=['167220ckuMgQ','13217523mtbciL','99261Voof

HIGH obfuscation-while-true: src/utils/create-conformance-rule.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';var a16_0x1f6fb5=a16_0x2663;(function(_0xe2cc4,_0x55a9e8){var _0x5d1823=a16_0x2663,_0x425372=_0xe2cc4();whi

HIGH obfuscation-while-true: src/utils/terminal-reporter-utils.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';const a17_0x5022ac=a17_0xf679;function a17_0xf679(_0x27d295,_0x299813){const _0x102699=a17_0x1026();return

HIGH obfuscation-while-true: testing/create-read-only-tree.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';const a19_0x251092=a19_0x38c4;(function(_0x80e3d2,_0x21461c){const _0x436ca3=a19_0x38c4,_0x14e4e1=_0x80e3d2

HIGH obfuscation-while-true: testing/index.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';var a20_0x422ab7=a20_0x1b14;(function(_0x3a51ff,_0x22b991){var _0x2e9aa8=a20_0x1b14,_0x216de8=_0x3a51ff();w

HIGH obfuscation-while-true: testing/temp-fs.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';const a21_0x1fb9a8=a21_0x108a;(function(_0x241372,_0x18f90b){const _0x592722=a21_0x108a,_0x4e2f38=_0x241372

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v5.0.1

22 findings
HIGH obfuscation-while-true: bin/conformance-check.js:2 semgrep

while(!![]) loop is a signature of javascript-obfuscator output 1 | #!/usr/bin/env node > 2 | 'use strict';const a0_0xd4e8f=a0_0x5e26;(function(_0x29d294,_0x48e8d1){const _0x46194e=a0_0x5e26,_0x1b539d=_0x29d294();w

HIGH obfuscation-while-true: bin/conformance.js:2 semgrep

while(!![]) loop is a signature of javascript-obfuscator output 1 | #!/usr/bin/env node > 2 | 'use strict';const a1_0x5f3725=a1_0x1a6e;function a1_0x1a6e(_0x56a011,_0x2b6074){const _0x3b59f3=a1_0x3b59();return a1_0

HIGH obfuscation-while-true: src/commands/conformance/command-object.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';function a2_0x3dc0(_0x49757e,_0x32219d){const _0x20f205=a2_0x20f2();return a2_0x3dc0=function(_0x3dc02d,_0x

HIGH obfuscation-while-true: src/commands/conformance/conformance.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';const a3_0x31d4eb=a3_0x594f;(function(_0x44fd27,_0x15b5eb){const _0x312947=a3_0x594f,_0x2c4008=_0x44fd27();

HIGH obfuscation-while-true: src/conformance-tree.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';const a4_0x251ce4=a4_0x2825;(function(_0x325723,_0x5247b4){const _0x1a9e0d=a4_0x2825,_0x3a1a08=_0x325723();

HIGH obfuscation-while-true: src/executors/bundle-rules/executor.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';const a5_0x246a7f=a5_0x5b44;(function(_0x365b2d,_0x5aeca3){const _0x58b82a=a5_0x5b44,_0x2b6f5a=_0x365b2d();

HIGH obfuscation-while-true: src/generators/create-rule/create-rule.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';const a6_0x4df49a=a6_0x4212;(function(_0x1bca9d,_0x59d49c){const _0x33b374=a6_0x4212,_0x41204c=_0x1bca9d();

HIGH obfuscation-while-true: src/generators/preset/preset.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';const a7_0x3e7d62=a7_0x46fc;function a7_0x2b5d(){const _0x184a06=['436806fbaBSt','npx\x20nx-cloud\x20publis

HIGH obfuscation-while-true: src/index.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';var a8_0x56f6ee=a8_0x39ae;(function(_0x550853,_0x59b991){var _0x525fc3=a8_0x39ae,_0x14c18b=_0x550853();whil

HIGH obfuscation-while-true: src/resolve-rule.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';const a9_0x5e329b=a9_0x572e;(function(_0x1038f5,_0xec911){const _0x4b2938=a9_0x572e,_0x4bf36d=_0x1038f5();w

HIGH obfuscation-while-true: src/rules-runner-obfuscated.bench.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';const a12_0x461f89=a12_0xeeca;function a12_0x562e(){const _0x276b83=['/virtual','//\x20file\x20content','be

HIGH obfuscation-while-true: src/rules-runner.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';const a13_0x89382=a13_0x19f1;(function(_0x53e12d,_0x4c08da){const _0x3a41b8=a13_0x19f1,_0x104d37=_0x53e12d(

HIGH obfuscation-while-true: src/rules/enforce-project-boundaries/index.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';const a10_0x52e780=a10_0x278c;(function(_0x25df98,_0x29fce2){const _0x337496=a10_0x278c,_0x491f03=_0x25df98

HIGH obfuscation-while-true: src/rules/ensure-owners/index.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';const a11_0x2e6ab1=a11_0x34e9;function a11_0x34e9(_0x3f7db1,_0x5b8733){const _0x2cc8f0=a11_0x2cc8();return

HIGH obfuscation-while-true: src/terminal-reporter.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';const a14_0xd6bfef=a14_0x5398;(function(_0x11ccae,_0x25869c){const _0x61cf9b=a14_0x5398,_0x57afb7=_0x11ccae

HIGH obfuscation-while-true: src/types.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';var a15_0x573370=a15_0x4230;function a15_0x31fc(){var _0x105c64=['603445csshDe','2433860qmoDFT','731cvnOiS'

HIGH obfuscation-while-true: src/utils/create-conformance-rule.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';var a16_0x395b99=a16_0x5f43;function a16_0x52d2(){var _0x6de2b2=['3149136MXhXuZ','__esModule','3247146rntsD

HIGH obfuscation-while-true: src/utils/terminal-reporter-utils.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';function a17_0x46a2(_0x3c1ed6,_0x4450d9){const _0x7467c8=a17_0x7467();return a17_0x46a2=function(_0x46a2cd,

HIGH obfuscation-while-true: testing/create-read-only-tree.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';const a19_0x54b5dc=a19_0x2e4b;(function(_0x19ab16,_0x5e7f3b){const _0x553479=a19_0x2e4b,_0x4d4c25=_0x19ab16

HIGH obfuscation-while-true: testing/index.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';var a20_0x26d2cf=a20_0x59a2;(function(_0x584863,_0x5f0405){var _0x6f3134=a20_0x59a2,_0x3db7bd=_0x584863();w

HIGH obfuscation-while-true: testing/temp-fs.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';const a21_0x4f9152=a21_0x1bb6;function a21_0x4610(){const _0x4bc530=['unlinkSync','symlinkSync','entries','

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v5.0.0

22 findings
HIGH obfuscation-while-true: bin/conformance-check.js:2 semgrep

while(!![]) loop is a signature of javascript-obfuscator output 1 | #!/usr/bin/env node > 2 | 'use strict';const a0_0x259dd5=a0_0x1575;function a0_0x1575(_0x2104b1,_0x90f473){const _0x2b7f97=a0_0x2b7f();return a0_0

HIGH obfuscation-while-true: bin/conformance.js:2 semgrep

while(!![]) loop is a signature of javascript-obfuscator output 1 | #!/usr/bin/env node > 2 | 'use strict';const a1_0x3ff2dc=a1_0x37fd;(function(_0x432f91,_0x46e843){const _0x1253d0=a1_0x37fd,_0x33a55b=_0x432f91();

HIGH obfuscation-while-true: src/commands/conformance/command-object.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';const a2_0xab73da=a2_0x5929;function a2_0x5929(_0x53a6ae,_0x48cc19){const _0x39ead8=a2_0x39ea();return a2_0

HIGH obfuscation-while-true: src/commands/conformance/conformance.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';function a3_0x2784(){const _0x10d9ad=['length','forEach','low','terminalReporter','picocolors','output','ma

HIGH obfuscation-while-true: src/conformance-tree.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';const a4_0x760d4b=a4_0x3abb;(function(_0x55c52a,_0x185534){const _0x5b01c2=a4_0x3abb,_0x5d1666=_0x55c52a();

HIGH obfuscation-while-true: src/executors/bundle-rules/executor.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';const a5_0x42f1d9=a5_0x240a;(function(_0x26013f,_0x4ed628){const _0x12d86d=a5_0x240a,_0x30b653=_0x26013f();

HIGH obfuscation-while-true: src/generators/create-rule/create-rule.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';const a6_0x447901=a6_0x3914;(function(_0xa990cf,_0x27fdcc){const _0x487f48=a6_0x3914,_0x5f5d7d=_0xa990cf();

HIGH obfuscation-while-true: src/generators/preset/preset.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';const a7_0x73d66a=a7_0x5812;(function(_0x4eab3d,_0x4971a7){const _0x49aa9b=a7_0x5812,_0x555f8c=_0x4eab3d();

HIGH obfuscation-while-true: src/index.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';var a8_0x45350e=a8_0x5e6b;(function(_0x1e8a93,_0x2d306f){var _0x59929c=a8_0x5e6b,_0x27fad2=_0x1e8a93();whil

HIGH obfuscation-while-true: src/resolve-rule.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';const a9_0x5b5ba8=a9_0x3ec5;function a9_0x3ec5(_0x4bf663,_0x2eecc5){const _0x380247=a9_0x3802();return a9_0

HIGH obfuscation-while-true: src/rules-runner-obfuscated.bench.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';function a12_0x46d3(){const _0x1b697a=['/virtual','800960MVbxTf','stringify','88JGoneS','A\x20rule\x20that\

HIGH obfuscation-while-true: src/rules-runner.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';const a13_0x4e9895=a13_0x4b75;function a13_0x59b3(){const _0x4b9d5a=['map','get','error','message','name','

HIGH obfuscation-while-true: src/rules/enforce-project-boundaries/index.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';function a10_0x36cd(){const _0x3baa0c=['buildTargetNames','A\x20dependency\x20on\x20an\x20e2e\x20project\x2

HIGH obfuscation-while-true: src/rules/ensure-owners/index.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';const a11_0x5c848c=a11_0x5d30;function a11_0x5d30(_0x3d5b5a,_0x478c22){const _0x2181c1=a11_0x2181();return

HIGH obfuscation-while-true: src/terminal-reporter.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';const a14_0x2833c1=a14_0x3149;(function(_0x324a50,_0x3e373d){const _0x3e60af=a14_0x3149,_0x5ee54c=_0x324a50

HIGH obfuscation-while-true: src/types.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';var a15_0x373b2f=a15_0x1e45;(function(_0x4070c9,_0x38af9a){var _0x25af82=a15_0x1e45,_0x583828=_0x4070c9();w

HIGH obfuscation-while-true: src/utils/create-conformance-rule.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';var a16_0x28ef3=a16_0x4fcf;function a16_0x4fcf(_0x31805f,_0x3981c5){var _0x259532=a16_0x2595();return a16_0

HIGH obfuscation-while-true: src/utils/terminal-reporter-utils.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';function a17_0x27ff(_0x210472,_0x120716){const _0x5a8359=a17_0x5a83();return a17_0x27ff=function(_0x27ff67,

HIGH obfuscation-while-true: testing/create-read-only-tree.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';const a19_0x59f257=a19_0x2cfc;function a19_0x12ba(){const _0x1ca7e7=['6996GuHnsP','/nx.json','write','__esM

HIGH obfuscation-while-true: testing/index.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';var a20_0x599ceb=a20_0x2022;(function(_0x10d1bd,_0x2259a7){var _0x40c705=a20_0x2022,_0x7ad8b3=_0x10d1bd();w

HIGH obfuscation-while-true: testing/temp-fs.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';const a21_0x3150d9=a21_0x5dc3;(function(_0xe133a2,_0x54c7d8){const _0x59e374=a21_0x5dc3,_0x320206=_0xe133a2

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.