nextjsupdater

{"schema_version":"1.7.4","id":"MAL-2026-15631","published":"2026-08-31T18:03:32Z","modified":"2026-09-23T04:24:34.104840211Z","summary":"Malicious code in nextjsupdater (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b01b587101f97acb47185dc58bab28ebfdf18a7619af7a664c17629339e2ddca)\nThe package masquerades as a Next.js updater but its exported `downloadAndRunUpdate` function fetches `updater.hta` from an unrelated personal GitHub repository (Acevatex/Testprogram) on the mutable `main` branch with no commit pin and no integrity check, writes it to the OS temp directory, and launches Windows `mshta.exe` detached with a hidden window (`spawn('mshta', [destPath], { detached: true, windowsHide: true })`). HTA is a well-known Windows LOLBIN that executes arbitrary script content with the privileges of the invoking user. The fetched content is attacker-mutable — the repository owner can change the HTA at any time — and the payload runs hidden and detached from the host process. The package name and API surface are designed to entice invocation from Next.js projects that believe they are pulling a framework update.\n","affected":[{"package":{"name":"nextjsupdater","ecosystem":"npm"},"versions":["1.2.1","1.0.0","1.2.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"343bfa3ca0d269c86d61de7fd3c164cb450f82397d637ea3a54d6b456d4b12a0","tlsh":"2811129784370d355c70a3c05b5a647fdb29821e731ac150fb6c0a24376ac0ad8a6cfd"},{"path":"package.json","sha256":"62c04be2473f11c8fd2133658bac7d9e55491b04a41d4b45fba2f3967281f973","tlsh":"9bd097102004d83316d0021804128423e4a1cc572100780e038f202cc3cea7364fe32d"}],"package_integrity":[{"filename":"nextjsupdater-1.2.1.tgz","hashes":{"sha1":"793dff4db593edc71d126c4543775f7ffc2153b4","sha512_sri":"sha512-pPONzJbaWgb4UiCycPNKOjMw5/BTv7+iJBEHFXaSYJRA4HHS99+Y8UcDESRW1KwyTLIyum7ym//oiuZIBRhOOA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/nextjsupdater/v/1.2.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/nextjsupdater/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/nextjsupdater/v/1.2.2"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-019312","import_time":"2026-08-31T18:22:29.802525556Z","modified_time":"2026-08-31T18:03:32Z","sha256":"3c72c588f940a53ee4432bb472a919af2dac7e6d86344c8427764f38d6412b93","source":"amazon-inspector","versions":["1.2.1"]},{"id":"IN-MAL-2026-020421","import_time":"2026-09-23T04:22:29.200940042Z","modified_time":"2026-09-23T04:06:35Z","sha256":"040ea55c04b86b5f78f5c71d5466f13dac7f967eb3bbf47ba90b13435bc26151","source":"amazon-inspector","versions":["1.0.0"]},{"id":"IN-MAL-2026-020422","import_time":"2026-09-23T04:22:29.355742461Z","modified_time":"2026-09-23T04:06:44Z","sha256":"b01b587101f97acb47185dc58bab28ebfdf18a7619af7a664c17629339e2ddca","source":"amazon-inspector","versions":["1.2.2"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}