MAL-2026-15631 Malicious code in nextjsupdater (npm)
Malicious package
Published
MAL-2026-15631 is a malicious package: nextjsupdater (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-15631/ (Markdown: https://insights.sbomify.com/MAL-2026-15631/index.md)
- Package
- nextjsupdater
- Registry
- npm
What is MAL-2026-15631?
MAL-2026-15631 is a malicious package in nextjsupdater, published on 31 Aug 2026.
Official description
The package masquerades as a Next.js updater but its exported
downloadAndRunUpdate function fetches updater.hta from an unrelated personal GitHub repository (Acevatex/Testprogram) on the mutable main branch with no commit pin and no integrity check, writes it to the OS temp directory, and launches Windows mshta.exe detached with a hidden window (spawn('mshta', [destPath], { detached: true, windowsHide: true })). HTA is a well-known Windows LOLBIN that executes arbitrary script content with the privileges of the invoking user. The fetched content is attacker-mutable — the repository owner can change the HTA at any time — and the payload runs hidden and detached from the host process. The package name and API surface are designed to entice invocation from Next.js projects that believe they are pulling a framework update.What should I do about MAL-2026-15631?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.