Microsoft Warns of Hackers Attacking Developers with Malicious Next.js Repositories

A cybersecurity campaign is targeting software developers using malicious repositories masquerading as Next.js projects and technical assessment materials. The attackers employ job-themed tactics to trick developers into cloning and executing compromised code, which connects to a command-and-control (C2) infrastructure, granting unauthorized access to the developer's systems and sensitive data.

The campaign was initially identified through unusual network activity from Node.js processes on affected machines, which were communicating with known C2 IP addresses. This prompted a detailed investigation that traced the Node.js executions to malicious repositories, including those on Bitbucket, disguised as recruitment-related technical assessments.

Further analysis by Microsoft Defender Experts identified a broader cluster of related repositories by examining shared code structures, loader logic, and naming patterns. Repository families such as "Cryptan," "JP-soccer," "RoyalJapan," and "SettleMint" featured near-identical variants, aiding the discovery of additional repositories with similar execution logic.

This campaign poses a significant risk to corporate development environments, as developer machines often have access to critical assets such as source code, environment secrets, cloud API keys, database credentials, and build pipelines. Compromise of a single device can expose an organization's entire infrastructure.

The attackers embed malicious behavior within projects that appear normal, facilitating reliable code execution while blending into routine developer workflows.

Three Entry Points, One Shared Backdoor

The campaign utilizes three execution paths, all leading to the runtime retrieval and execution of attacker-controlled JavaScript:

Visual Studio Code Automation: When a developer opens a project folder, a pre-configured .vscode/tasks.json file immediately triggers a Node.js script fetching a JavaScript loader from a Vercel-hosted endpoint.

Development Server Start: Executing npm run dev triggers Trojanized assets to retrieve the JavaScript loader from Vercel.

Server Startup: Malicious backend routes decode a base64 endpoint from a .env file, transmitting the process environment to the attacker and executing JavaScript via dynamic compilation.

Once triggered, a Stage 1 payload profiles the host and polls the C2 server at fixed intervals. Stage 2 takes over to perform tasks such as directory browsing, file collection, and data uploads to attacker infrastructure.

Developers should enable Visual Studio Code Workspace Trust and Restricted Mode to block automatic code execution in unknown folders. Organizations should implement attack surface reduction rules to prevent obfuscated script execution, enforce strong authentication, and avoid storing production credentials on development machines. Security teams should monitor for unusual Node.js outbound connections and conduct identity risk assessments if developer endpoints are compromised.

Based on reporting by Cyber Security News.