Malicious code in nextjsupdater (npm)
Historical advisory saved 24 Oct 2026 13:17:17 UTC. The publisher may have updated it since then. Latest advisory.
osv · MAL-2026-15631
Published--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (b01b587101f97acb47185dc58bab28ebfdf18a7619af7a664c17629339e2ddca) The package masquerades as a Next.js updater but its exported `downloadAndRunUpdate` function fetches `updater.hta` from an unrelated personal GitHub repository (Acevatex/Testprogram) on the mutable `main` branch with no commit pin and no integrity check, writes it to the OS temp directory, and launches Windows `mshta.exe` detached with a hidden window (`spawn('mshta', [destPath], { detached: true, windowsHide: true })`). HTA is a well-known Windows LOLBIN that executes arbitrary script content with the privileges of the invoking user. The fetched content is attacker-mutable — the repository owner can change the HTA at any time — and the payload runs hidden and detached from the host process. The package name and API surface are designed to entice invocation from Next.js projects that believe they are pulling a framework update.
- Source published
- 31 Aug 2026 18:03:32 UTC
- Source modified
- 23 Sep 2026 04:31:17 UTC
- Saved here
- 24 Oct 2026 13:17:17 UTC
- Source terms
- OSV · upstream source license applies
Original source record · Cite this exact observation · Complete original publisher JSON
Source: osv · OSV · upstream source license applies. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.