nextjsupdater@1.2.2

Summary

The package masquerades as a Next.js updater but its exported downloadAndRunUpdate function fetches updater.hta from an unrelated personal GitHub repository (Acevatex/Testprogram) on the mutable main branch with no commit pin and no integrity check, writes it to the OS temp directory, and launches Windows mshta.exe detached with a hidden window (spawn('mshta', [destPath], { detached: true, windowsHide: true })). HTA is a well-known Windows LOLBIN that executes arbitrary script content with the privileges of the invoking user. The fetched content is attacker-mutable — the repository owner can change the HTA at any time — and the payload runs hidden and detached from the host process. The package name and API surface are designed to entice invocation from Next.js projects that believe they are pulling a framework update.

Source: amazon-inspector (b01b587101f97acb47185dc58bab28ebfdf18a7619af7a664c17629339e2ddca)