Repository navigation
Why there is obfuscated code in my next.config.js #90926
Replies: 3 comments 2 replies
|
That definitely looks out of place. Is it only present in your The code you showed is heavily obfuscated and appears to dynamically reconstruct and execute a hidden payload at runtime using This is not something you would expect from Next.js itself or from reputable monitoring/observability packages, especially inside I would treat this as a potential incident. Recommended steps:
If this code is only present on the deployed instance and not in source control, that strongly suggests the deployed environment or build pipeline may have been modified. |
|
Related to https://opensourcemalware.com/blog/neutralinojs-compromise |
|
Heya @sysophost we got a big blog coming about this attack. I'm literally writing it now... 500+ repos affected, hundreds of GitHub users |
|
This is a known supply-chain attack — not something Next.js injects. As noted in this thread, the obfuscated code in your The malicious code uses a common obfuscation pattern:
This is NOT injected by Next.js or Vercel at build time. Next.js never modifies your Immediate action checklist: 1. Treat this as a security incident right now:
2. Find the source: # Check git history to find when this was introduced
git log --all --follow -p next.config.js | grep -A5 -B5 "_\$_"
# Check if it's in source control at all, or only on disk
git diff HEAD -- next.config.js
3. Audit your dependency tree: # Check for recently changed packages
npm audit
# Look for suspicious postinstall/preinstall scripts
cat node_modules/.package-lock.json | grep -A3 '"scripts"'Pay particular attention to packages installed or updated in the same timeframe the obfuscated code appeared. The attack vector is likely a compromised npm package with a malicious 4. Check your CI/CD pipeline:
5. Clean up:
How to detect hidden whitespace: To see if there's still hidden code embedded in whitespace, run: # Show non-printing characters - look for unexpected chars between whitespace
cat -A next.config.js
# Or check file byte count — if it's much larger than it looks, something is hidden
wc -c next.config.js
ls -la next.config.jsAlso run the same check against other config files ( The key takeaway: Next.js is not the source of this code. This is a supply-chain attack via a compromised npm dependency, and your first priority should be credential rotation. |
|
Even though this is nothing other than a repost, it does surface a few bits of info that others might not infer from the thread so far, so I'll keep it. I did consider marking it at as On the same note, keep the spam down. GitHub UI collapse (hiding comments when several items exist on a thread) may accidentally hide important information from others, when threads are spammed with useless void comments. |
Uh oh!
There was an error while loading. Please reload this page.
Summary
Hi,
I came across some strange code in my repository and I'm not sure how it got there. I wanted to check whether this could be something that gets injected at build time.
It appears to be obfuscated code embedded in a file, hidden with whitespace — so if you view the file normally, it's not immediately visible.
Additional information
Example
No response
All reactions