Security

Malicious Next.js Repos Target Developers via VS Code

3 min read

Summary

Microsoft Defender Experts uncovered a campaign using malicious Next.js repositories, often disguised as job take-home assignments, to compromise developers through normal VS Code and app startup workflows. The repos can automatically execute attacker-controlled JavaScript on folder open or when the project is run, potentially exposing source code, environment variables, and cloud credentials—making this a serious supply-chain and developer workstation security threat.

Need help with Security?Talk to an Expert

Introduction: why this matters

Developer workstations and build environments are high-value targets because they often hold source code, signing material, and secrets (API tokens, cloud credentials) in environment variables. Microsoft Defender Experts reports a campaign seeding malicious Next.js repositories—often wrapped as job-related “take-home” assessments—designed to blend into normal developer workflows and reliably trigger code execution.

What’s new / key findings

Microsoft observed multiple related repositories with shared naming conventions and reused loader logic. While the initial lure varies, the end state is consistent: runtime retrieval and in-memory execution of attacker-controlled JavaScript, followed by staged C2.

1) VS Code workspace execution on folder open

Some repos include .vscode/tasks.json configured with runOn: "folderOpen". If a developer opens (and trusts) the project, a task runs automatically and launches a Node script that fetches a JavaScript loader (observed staged on Vercel) and executes it.

2) Build-time execution when running the app

Other variants trigger when a developer starts the project (for example, npm run dev). These repos embed malicious logic in seemingly normal assets (e.g., a trojanized jquery.min.js). The asset decodes a base64 URL, retrieves the loader (again, frequently from Vercel), and executes it in memory.

3) Backend startup execution with env exfiltration + dynamic RCE

A third path activates during server initialization/module import. Repos may contain a .env value like AUTH_API=<base64>. On startup, backend code decodes the endpoint, posts process.env to the attacker, then executes returned JavaScript using dynamic compilation (e.g., new Function("require", response.data)(require)). This can leak sensitive configuration and enables operator-driven follow-on payload delivery.

Stage 1 registration → staged command-and-control

Across all paths, execution converges on an initial “registrar” stage that profiles the host and polls a registration endpoint, receiving an instanceId to correlate subsequent activity. Telemetry also noted persistent callbacks to attacker-controlled infrastructure (including HTTP traffic on port 300) after initial staging.

Impact for IT admins and security teams

  • Higher risk on developer endpoints: Opening a repo can be enough to execute code if workspace tasks are trusted.
  • Credential exposure: The backend startup path can exfiltrate environment variables (cloud keys, database credentials, CI tokens).
  • Harder detection: In-memory execution and staged loaders can reduce obvious on-disk artifacts.

Action items / next steps

  • Developer guidance: Treat take-home assessments and unfamiliar repos as untrusted; avoid clicking “Trust” in VS Code until reviewed.
  • Repo inspection: Flag/inspect .vscode/tasks.json (especially runOn: "folderOpen"), unexpected Node scripts under .vscode/, and minified libraries that don’t match known-good hashes.
  • Secret hygiene: Reduce reliance on long-lived secrets in .env; use managed identities/short-lived tokens where possible and rotate any exposed credentials.
  • Detection & controls: Monitor Node.js processes for unusual outbound connections (e.g., dev tools calling staging domains followed by unknown C2), and consider egress restrictions from developer devices and build agents.
  • Hunting: Search code hosting and internal mirrors for naming “families” and structural reuse patterns described by Microsoft (near-duplicate repos, similar loaders, repeated staging endpoints).

Need help with Security?

Our experts can help you implement and optimize your Microsoft solutions.

Talk to an Expert

Stay updated on Microsoft technologies

Read the original article by Microsoft Defender Experts and Microsoft Defender Security Research Team
Microsoft DefenderNext.jssupply chain securityVisual Studio CodeNode.js

Related Posts

Security

AI Memory Security in Microsoft 365 Explained

Microsoft has outlined how it secures AI memory in Microsoft 365, addressing emerging risks such as memory poisoning and delayed tool execution. The update matters because persistent AI memory can improve personalization and agent performance, but it also creates new security, compliance, and audit requirements for IT and security teams.

Security

Parallel Threat Activity: Microsoft DART Findings

Microsoft Incident Response detailed a complex intrusion in which two unrelated threat actors operated simultaneously in the same environment, complicating attribution and detection. The case highlights how ransomware activity, SharePoint exploitation, trusted tool abuse, and identity compromise can overlap across hybrid estates, reinforcing the need for strong telemetry, patching, and coordinated response.

Security

AutoJack RCE in AutoGen Studio: Security Lessons

Microsoft security researchers detailed AutoJack, an exploit chain in AutoGen Studio that could let untrusted web content rendered by an AI browsing agent trigger remote code execution on the host. Although the vulnerable MCP WebSocket surface was never shipped in a PyPI release and the issue was hardened upstream during development, the findings highlight important security risks for agent frameworks that combine web browsing with privileged local services.

Security

Microsoft Security Forrester Study Reports 124% ROI

A new Forrester Total Economic Impact study found that organizations consolidating on Microsoft Security could see a projected 124% ROI over three years. The report highlights lower breach risk, reduced remediation costs, lower technology spend, and productivity gains as key reasons unified security platforms matter in the AI era.

Security

Mastra npm Supply Chain Attack: What IT Teams Need to Know

Microsoft has detailed a large-scale npm supply chain compromise affecting more than 140 Mastra packages after an attacker took over a maintainer account and injected a malicious dependency. The attack is significant because the payload executed during npm install, putting developer workstations and CI/CD pipelines at risk even if the package was never directly used in code.

Security

Crypto Clipper Malware Uses Tor and USB Worm Spread

Microsoft has detailed a Windows-based crypto clipper campaign that uses malicious shortcut files, a bundled Tor client, and worm-like USB propagation to steal wallet data and maintain persistence. The threat matters because it combines clipboard theft, screenshot exfiltration, and remote code execution with stealthy Tor-based command and control, making behavioral detection critical for defenders.