Cache Poisoning Threat in Nx and Lerna Monorepos Addressed

A security vulnerability in Nx and Lerna monorepos, designated CVE-2025-36852 (CREEP), allows for cache poisoning. The risk occurs when a single token grants both read and write access to a shared remote cache, enabling malicious builds to inject harmful artifacts. These poisoned artifacts can then be downloaded and executed by developers or automated CI pipelines. The recommended mitigation is using separate read-only and read-write tokens, as implemented in Cacheiro version 1.3.0. This approach restricts untrusted environments, like pull request builds, from writing to the central cache.