Malicious Repositories Target Next.js Developers with Covert RCE Attacks

Cybersecuritynews

Malicious Repositories Target Next.js Developers with Covert RCE Attacks

First seen 25 Feb 2026, 17:12 UTC • •26.3

Article Content

1 / 11

Browse articles

ThreatCluster •March 12, 2026 at 16:10 UTC

Hackers are targeting JavaScript developers by seeding malicious repositories that appear legitimate. Microsoft reported that these repositories exploit standard build workflows to execute malicious JavaScript in memory, leading to remote code execution and command-and-control activities. The campaign specifically affects developers working with Next.js frameworks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 183d ago How this analysis works

Timeline

2026-02-24

Microsoft reports on malicious .js repositories targeting developers

2026-02-25

The Register publishes article on the same malicious campaign

More articles in this cluster (10)

Threat Graph

14 entities, 19 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (8)

Data Breach
Malware
Supply Chain Attack
Trojan
T1041 - Exfiltration Over C2 Channel
T1059.007 - JavaScript
T1059 - Command and Scripting Interpreter
T1071 - Application Layer Protocol

Organization (1)

Vercel

Affected Platform (2)

Next.js
Visual Studio Code

Tool (3)

BitBucket
Node.js
Npm

Relationships

Data Breach targets Next.js
Data Breach targets Visual Studio Code
Malware targets Next.js
Malware targets Visual Studio Code
Supply Chain Attack targets Next.js
Supply Chain Attack targets Visual Studio Code
Trojan targets Next.js
Trojan targets Visual Studio Code
T1041 - Exfiltration Over C2 Channel targets Next.js
T1041 - Exfiltration Over C2 Channel targets Visual Studio Code
T1059.007 - JavaScript targets Next.js
T1059.007 - JavaScript targets Visual Studio Code
T1059 - Command and Scripting Interpreter targets Next.js
T1059 - Command and Scripting Interpreter targets Visual Studio Code
T1071 - Application Layer Protocol targets Next.js
T1071 - Application Layer Protocol targets Visual Studio Code
BitBucket related to Vercel
BitBucket related to Node.js
BitBucket related to Npm

Following this threat?

Track Vercel in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical Cisco FMC Vulnerabilities Under Active Exploitation Cisco's Secure Firewall Management Center (FMC) Software has two critical vulnerabilities, CVE-2026-20079 and CVE-2026-20316, that are currently being exploited by state-sponsored and ransomware actors. CVE-2026-20079, rated 10.0 on the CVSS scale, allows unauthenticated remote attackers to bypass authentication and…

Critical GitLab Vulnerabilities Exploited Within Hours of Disclosure On September 10, 2026, GitLab released patches for critical vulnerabilities CVE-2026-85706 and CVE-2026-87719. CVE-2026-85706, a path traversal flaw, allows unauthenticated users to read arbitrary files from GitLab servers, while CVE-2026-87719 enables credential theft via insecure deserialization. Both…