Lerna/NX Hacked. Theia affected?

[ngfelixl]

Hi everyone,
NX build tools have been hacked. It's fixed already and affected versions (see links) have been taken off npm.

• https://semgrep.dev/blog/2025/security-alert-nx-compromised-to-steal-wallets-and-credentials/
• Github.com Nrwl/NX Advisories

Lerna depends on NX.
Is Theia affected and how should we take care?

[sdirix]

In Theia itself we are using older versions of lerna/nx which are not affected.

@theia/monorepo
└─┬ lerna@7.4.2
  ├─┬ @lerna/create@7.4.2
  │ └── nx@16.10.0 deduped
  ├─┬ @nx/devkit@16.10.0
  │ └── nx@16.10.0 deduped
  └─┬ nx@16.10.0
    └─┬ @nrwl/tao@16.10.0
      └── nx@16.10.0 deduped

Same in Theia IDE:

theia-ide@1.64.100
└─┬ lerna@6.6.2
  ├─┬ @nrwl/devkit@15.9.7
  │ └── nx@15.9.7 deduped
  └─┬ nx@15.9.7
    ├─┬ @nrwl/cli@15.9.7
    │ └── nx@15.9.7 deduped
    └─┬ @nrwl/tao@15.9.7
      └── nx@15.9.7 deduped

Of course downstream adopters could use later versions, it's just that our repositories are not affected

[ngfelixl]

Thanks! :)