{"id":"MAL-2026-15631","revision":"7824eeeb9afc4331b3d14fd7898aa4c8","records":[{"revision":"7824eeeb9afc4331b3d14fd7898aa4c8","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-15631","aliases":[],"title":"Malicious code in nextjsupdater (npm)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b01b587101f97acb47185dc58bab28ebfdf18a7619af7a664c17629339e2ddca)\nThe package masquerades as a Next.js updater but its exported `downloadAndRunUpdate` function fetches `updater.hta` from an unrelated personal GitHub repository (Acevatex/Testprogram) on the mutable `main` branch with no commit pin and no integrity check, writes it to the OS temp directory, and launches Windows `mshta.exe` detached with a hidden window (`spawn('mshta', [destPath], { detached: true, windowsHide: true })`). HTA is a well-known Windows LOLBIN that executes arbitrary script content with the privileges of the invoking user. The fetched content is attacker-mutable — the repository owner can change the HTA at any time — and the payload runs hidden and detached from the host process. The package name and API surface are designed to entice invocation from Next.js projects that believe they are pulling a framework update.\n","state":0,"publishedAt":"2026-08-31T18:03:32+00:00","modifiedAt":"2026-09-23T04:31:17.5113442+00:00","affected":[{"ecosystem":"npm","name":"nextjsupdater","ranges":[],"versions":["1.2.1","1.0.0","1.2.2"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/nextjsupdater/v/1.2.1","https://www.npmjs.com/package/nextjsupdater/v/1.0.0","https://www.npmjs.com/package/nextjsupdater/v/1.2.2"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-15631","license":"OSV · upstream source license applies","key":"osv:MAL-2026-15631","identifiers":["MAL-2026-15631"]},"retained":false,"historicalAffected":[]}],"coverage":[]}