{"id":"MAL-2026-15631","summary":"Malicious code in nextjsupdater (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b01b587101f97acb47185dc58bab28ebfdf18a7619af7a664c17629339e2ddca)\nThe package masquerades as a Next.js updater but its exported `downloadAndRunUpdate` function fetches `updater.hta` from an unrelated personal GitHub repository (Acevatex/Testprogram) on the mutable `main` branch with no commit pin and no integrity check, writes it to the OS temp directory, and launches Windows `mshta.exe` detached with a hidden window (`spawn('mshta', [destPath], { detached: true, windowsHide: true })`). HTA is a well-known Windows LOLBIN that executes arbitrary script content with the privileges of the invoking user. The fetched content is attacker-mutable — the repository owner can change the HTA at any time — and the payload runs hidden and detached from the host process. The package name and API surface are designed to entice invocation from Next.js projects that believe they are pulling a framework update.\n","modified":"2026-09-23T04:31:17.511344153Z","published":"2026-08-31T18:03:32Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-08-31T18:03:32Z","sha256":"3c72c588f940a53ee4432bb472a919af2dac7e6d86344c8427764f38d6412b93","source":"amazon-inspector","versions":["1.2.1"],"id":"IN-MAL-2026-019312","import_time":"2026-08-31T18:22:29.802525556Z"},{"modified_time":"2026-09-23T04:06:35Z","sha256":"040ea55c04b86b5f78f5c71d5466f13dac7f967eb3bbf47ba90b13435bc26151","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-020421","import_time":"2026-09-23T04:22:29.200940042Z"},{"import_time":"2026-09-23T04:22:29.355742461Z","modified_time":"2026-09-23T04:06:44Z","sha256":"b01b587101f97acb47185dc58bab28ebfdf18a7619af7a664c17629339e2ddca","source":"amazon-inspector","versions":["1.2.2"],"id":"IN-MAL-2026-020422"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/nextjsupdater/v/1.2.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/nextjsupdater/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/nextjsupdater/v/1.2.2"}],"affected":[{"package":{"name":"nextjsupdater","ecosystem":"npm","purl":"pkg:npm/nextjsupdater"},"versions":["1.2.1","1.0.0","1.2.2"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"package_integrity":[{"filename":"nextjsupdater-1.2.1.tgz","hashes":{"sha1":"793dff4db593edc71d126c4543775f7ffc2153b4","sha512_sri":"sha512-pPONzJbaWgb4UiCycPNKOjMw5/BTv7+iJBEHFXaSYJRA4HHS99+Y8UcDESRW1KwyTLIyum7ym//oiuZIBRhOOA=="}}],"evidence_files":[{"tlsh":"2811129784370d355c70a3c05b5a647fdb29821e731ac150fb6c0a24376ac0ad8a6cfd","path":"index.js","sha256":"343bfa3ca0d269c86d61de7fd3c164cb450f82397d637ea3a54d6b456d4b12a0"},{"sha256":"62c04be2473f11c8fd2133658bac7d9e55491b04a41d4b45fba2f3967281f973","tlsh":"9bd097102004d83316d0021804128423e4a1cc572100780e038f202cc3cea7364fe32d","path":"package.json"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/nextjsupdater/MAL-2026-15631.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}