September 2025 Summaries

Miroslav Jonas will present a webinar on September 24, 2025, at 2pm ET/6pm UTC, discussing the evolution and current state of monorepos and monorepo tooling, which have significantly adapted to meet the practical needs of large teams. As development environments become increasingly complex, with a focus on scalability and higher productivity using fewer resources, modern monorepos offer an effective solution to bring order to such complexity. The webinar will cover the appearance of monorepo development in 2025, the advantages of utilizing more intelligent monorepos, strategies for securing support from leadership and teams, and how the tool Nx enhances the ease and power of monorepo development. Participants are encouraged to download the recording and sign up for access.

The text discusses integrating Biome, a fast linter and formatter written in Rust, into an Nx workspace to enhance code quality and efficiency. It highlights the steps to set up Biome independently, using npm scripts, and how to target individual projects for linting within a monorepo. The piece elaborates on integrating Biome with Nx, emphasizing the advantage of using Nx's caching and inferred task features to improve performance and scalability. It also describes creating a custom Nx plugin to automate the integration and configuration of Biome across multiple projects, allowing for selective adoption and progressive transitions. The process demonstrates the power and flexibility of custom plugins over waiting for official support, providing a tailored solution for specific team needs.

In August 2025, malicious versions of several Nx packages were published to npm due to a GitHub Actions injection vulnerability that allowed attackers to steal an NPM publishing token. This token was used to publish harmful packages for four hours, which scanned user systems for sensitive data and uploaded it to public GitHub repositories. The Nx team responded by removing the affected packages, revoking the compromised token, and implementing stricter security measures including the use of NPM Trusted Publishers and manual approval processes for releases. The incident did not affect Nx Cloud and was isolated to Nx's open-source packages. The company has since enhanced its security protocols by disabling workflows for external contributors and adopting OIDC authentication for package publishing. They also emphasized the importance of securing sensitive data locally and using secure credential management. Through transparency about the breach, Nx aims to raise awareness of potential vulnerabilities in GitHub workflows and the necessity of rigorous security practices.