MAL-2026-15631

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/nextjsupdater/MAL-2026-15631.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15631
Published
2026-08-31T18:03:32Z
Modified
2026-09-23T04:31:17Z
Summary
Malicious code in nextjsupdater (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b01b587101f97acb47185dc58bab28ebfdf18a7619af7a664c17629339e2ddca)

The package masquerades as a Next.js updater but its exported downloadAndRunUpdate function fetches updater.hta from an unrelated personal GitHub repository (Acevatex/Testprogram) on the mutable main branch with no commit pin and no integrity check, writes it to the OS temp directory, and launches Windows mshta.exe detached with a hidden window (spawn('mshta', [destPath], { detached: true, windowsHide: true })). HTA is a well-known Windows LOLBIN that executes arbitrary script content with the privileges of the invoking user. The fetched content is attacker-mutable — the repository owner can change the HTA at any time — and the payload runs hidden and detached from the host process. The package name and API surface are designed to entice invocation from Next.js projects that believe they are pulling a framework update.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-019312",
            "import_time":  "2026-08-31T18:22:29.802525556Z",
            "modified_time":  "2026-08-31T18:03:32Z",
            "sha256":  "3c72c588f940a53ee4432bb472a919af2dac7e6d86344c8427764f38d6412b93",
            "source":  "amazon-inspector",
            "versions":  [
                "1.2.1"
            ]
        },
        {
            "id":  "IN-MAL-2026-020421",
            "import_time":  "2026-09-23T04:22:29.200940042Z",
            "modified_time":  "2026-09-23T04:06:35Z",
            "sha256":  "040ea55c04b86b5f78f5c71d5466f13dac7f967eb3bbf47ba90b13435bc26151",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-020422",
            "import_time":  "2026-09-23T04:22:29.355742461Z",
            "modified_time":  "2026-09-23T04:06:44Z",
            "sha256":  "b01b587101f97acb47185dc58bab28ebfdf18a7619af7a664c17629339e2ddca",
            "source":  "amazon-inspector",
            "versions":  [
                "1.2.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / nextjsupdater

Package

Name
nextjsupdater
View open source insights on deps.dev
Purl
pkg:npm/nextjsupdater

Affected ranges

Affected versions

1.*
1.0.0
1.2.1
1.2.2

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "index.js",
            "sha256":  "343bfa3ca0d269c86d61de7fd3c164cb450f82397d637ea3a54d6b456d4b12a0",
            "tlsh":  "2811129784370d355c70a3c05b5a647fdb29821e731ac150fb6c0a24376ac0ad8a6cfd"
        },
        {
            "path":  "package.json",
            "sha256":  "62c04be2473f11c8fd2133658bac7d9e55491b04a41d4b45fba2f3967281f973",
            "tlsh":  "9bd097102004d83316d0021804128423e4a1cc572100780e038f202cc3cea7364fe32d"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "nextjsupdater-1.2.1.tgz",
            "hashes":  {
                "sha1":  "793dff4db593edc71d126c4543775f7ffc2153b4",
                "sha512_sri":  "sha512-pPONzJbaWgb4UiCycPNKOjMw5/BTv7+iJBEHFXaSYJRA4HHS99+Y8UcDESRW1KwyTLIyum7ym//oiuZIBRhOOA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/nextjsupdater/MAL-2026-15631.json"