Which versions of nextjsupdater are malicious?

The following npm versions of nextjsupdater are flagged malicious: 1.0.0, 1.2.1, 1.2.2. Treat any of these as compromised.

How do I remediate nextjsupdater if I installed it?

Remove nextjsupdater from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed nextjsupdater — how do I know if it already compromised me?

If nextjsupdater was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is nextjsupdater part of a known attack campaign?

Yes — nextjsupdater is associated with the IN-MAL-2026-019312, IN-MAL-2026-020421, IN-MAL-2026-020422 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find nextjsupdater across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for nextjsupdater (3 malicious versions).

Malicious package

nextjsupdaternpm

Advisory published Aug 31, 2026Updated Sep 23, 2026

nextjsupdater is a confirmed malicious npm package (MAL-2026-15631) that executes malicious code on install (malicious versions 1.0.0, 1.2.1, 1.2.2). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in nextjsupdater (npm)

MAL-2026-15631

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall nextjsupdater

What this malware does

The package masquerades as a Next.js updater but its exported downloadAndRunUpdate function fetches updater.hta from an unrelated personal GitHub repository (Acevatex/Testprogram) on the mutable main branch with no commit pin and no integrity check, writes it to the OS temp directory, and launches Windows mshta.exe detached with a hidden window (spawn('mshta', [destPath], { detached: true, windowsHide: true })). HTA is a well-known Windows LOLBIN that executes arbitrary script content with the privileges of the invoking user. The fetched content is attacker-mutable — the repository owner can change the HTA at any time — and the payload runs hidden and detached from the host process. The package name and API surface are designed to entice invocation from Next.js projects that believe they are pulling a framework update.

Malicious versions

3 flagged

1.0.01.2.11.2.2

Indicators of compromise (SHA-256)

3c72c588f940a53ee4432bb472a919af2dac7e6d86344c8427764f38d6412b93

040ea55c04b86b5f78f5c71d5466f13dac7f967eb3bbf47ba90b13435bc26151

b01b587101f97acb47185dc58bab28ebfdf18a7619af7a664c17629339e2ddca

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for nextjsupdater (3 malicious versions).
If you installed it — respond
Remove nextjsupdater from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If nextjsupdater was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. nextjsupdater on npm has been identified as a malicious package (versions 1.0.0, 1.2.1, 1.2.2 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-019312IN-MAL-2026-020421IN-MAL-2026-020422

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks nextjsupdater-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database