MAL-2026-15631

    Dashboard / Malicious Package / MAL-2026-15631

    MAL-2026-15631

    Published: 31 Aug 2026Last Modified: 23 Sept 2026

    Summary: Malicious code in nextjsupdater (npm)

    Details: Source: amazon-inspector (b01b587101f97acb47185dc58bab28ebfdf18a7619af7a664c17629339e2ddca) The package masquerades as a Next.js updater but its exported `downloadAndRunUpdate` function fetches `updater.hta` from an unrelated personal GitHub repository (Acevatex/Testprogram) on the mutable `main` branch with no commit pin and no integrity check, writes it to the OS temp directory, and launches Windows `mshta.exe` detached with a hidden window (`spawn('mshta', [destPath], { detached: true, windowsHide: true })`). HTA is a well-known Windows LOLBIN that executes arbitrary script content with the privileges of the invoking user. The fetched content is attacker-mutable — the repository owner can change the HTA at any time — and the payload runs hidden and detached from the host process. The package name and API surface are designed to entice invocation from Next.js projects that believe they are pulling a framework update.

    References: https://www.npmjs.com/package/nextjsupdater/v/1.2.1, https://www.npmjs.com/package/nextjsupdater/v/1.0.0, https://www.npmjs.com/package/nextjsupdater/v/1.2.2

    Affected packages

    Package

    Name: nextjsupdater

    Purl: pkg:npm/nextjsupdater

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.2.1
    1.2.2