Fake Next.js assessments become a route into developer machines

Microsoft described on 24 February a developer-targeting campaign that packaged malicious code as Next.js projects and technical assessments. Investigators first connected suspicious network activity to Node.js processes, then examined related repositories and shared execution patterns. Some related repositories were identified through code analysis rather than directly observed compromises.

The reported chains retrieved attacker-controlled JavaScript at runtime and supported later control of the host. A plausible project structure did not make executing an unfamiliar recruitment exercise safe. The report separates repositories found in telemetry from the broader set linked by shared artefacts. It does not establish that every repository using the same framework or hiring format was malicious, or that every discovered copy infected a developer.