A critical security vulnerability exists in remote cache extensions for common build systems utilizing bucket-based remote cache (such as those using Amazon S3, Google Cloud Storage, or similar object storage) that allows any contributor with pull request privileges to inject compromised artifacts from an untrusted environment into trusted production environments without detection.
The vulnerability exploits a fundamental design flaw in the "first-to-cache wins" principle, where artifacts built in untrusted environments (feature branches, pull requests) can poison the cache used by trusted environments (protected branches, production deployments).
This attack bypasses all traditional security measures including encryption, access controls, and checksum validation because the poisoning occurs during the artifact construction phase, before any security measures are applied.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Azure Based Remote Cache Plugin for Nx
Vendor
Niklas Portmann
Product
Azure Based Remote Cache Plugin for Nx
Platforms
Unknown
Default status
affected
Package
nx-remotecache-azure
Package collection
https://registry.npmjs.org
Azure Based Remote Cache Plugin for Nx · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
Unavailable
None listed
Minio Based Remote Cache Plugin for Nx
Vendor
Niklas Portmann
Product
Minio Based Remote Cache Plugin for Nx
Platforms
Unknown
Default status
affected
Package
nx-remotecache-minio
Package collection
https://registry.npmjs.org
Minio Based Remote Cache Plugin for Nx · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
Unavailable
None listed
Nx Remote Cache Utilities
Vendor
Niklas Portmann
Product
Nx Remote Cache Utilities
Platforms
Unknown
Default status
affected
Package
nx-remotecache-custom
Package collection
https://registry.npmjs.org
Nx Remote Cache Utilities · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
Unavailable
None listed
AWS S3 Remote Cache Plugin for Nx
Vendor
Nx
Product
AWS S3 Remote Cache Plugin for Nx
Platforms
Unknown
Default status
affected
Package
@nx/s3-cache
Package collection
https://registry.npmjs.org
AWS S3 Remote Cache Plugin for Nx · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
Unavailable
None listed
GCS Remote Cache Plugin for Nx
Vendor
Nx
Product
GCS Remote Cache Plugin for Nx
Platforms
Unknown
Default status
affected
Package
@nx/gcs-cache
Package collection
https://registry.npmjs.org
GCS Remote Cache Plugin for Nx · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
Unavailable
None listed
Azure Blob Remote Cache Plugin for Nx
Vendor
Nx
Product
Azure Blob Remote Cache Plugin for Nx
Platforms
Unknown
Default status
affected
Package
@nx/azure-cache
Package collection
https://registry.npmjs.org
Azure Blob Remote Cache Plugin for Nx · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
Unavailable
None listed
Shared File System Cache Plugin for Nx
Vendor
Nx
Product
Shared File System Cache Plugin for Nx
Platforms
Unknown
Default status
affected
Package
@nx/shared-fs-cache
Package collection
https://registry.npmjs.org
Shared File System Cache Plugin for Nx · Scoped product and version facts