Malicious Next.js Repositories — Developer-Targeting C2 Campaign via VSCode Workspace Abuse, Job-Themed Lures, and Staged JavaScript Execution
Malicious Next.js Repositories (TL-2026-0139), also tracked as DEV#POPPER Campaign, is a critical-severity supply-chain compromise, first published 2026-02-24. It is attributed to Contagious Interview (North Korea) with medium confidence, affects Microsoft Visual Studio Code, maps to 26 MITRE ATT&CK techniques (T1005, T1016, T1027), and is covered by 9 detection rules and 47 indicators of compromise.
Key facts for TL-2026-0139
- Threat ID
- TL-2026-0139
- Also known as
- DEV#POPPER Campaign, Contagious Interview Variant
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-02-24
- Last reviewed
- 2026-02-24
- Attribution
- Contagious Interview
- Attribution confidence
- MEDIUM
- Nation-state nexus
- North Korea
- Motivation
- ESPIONAGE
- Target sectors
- technology, software-development, cryptocurrency, financial, cloud-services
- Target regions
- Global, North America, Europe, Asia
- Detection rules
- 9
- Indicators of compromise
- 47
Microsoft Defender Experts identified a coordinated campaign using malicious GitHub/Bitbucket repositories disguised as legitimate Next.js projects and technical assessment materials. Three execution paths (VSCode workspace auto-execution, npm build-time trojanized assets, and backend module dynamic RCE) converge on two-stage JavaScript C2 with in-memory execution, targeting developer systems for source code, environment secrets, and cloud credentials.
How Malicious Next.js Repositories works
Microsoft Defender Experts identified a coordinated developer-targeting campaign delivered through malicious repositories disguised as legitimate Next.js projects and technical assessment materials. The campaign uses job-themed lures to blend into routine developer workflows — particularly recruiting-themed "technical assessments" — and increases the likelihood of code execution by abusing trusted development tools and patterns.
Multiple repository families were identified across GitHub and Bitbucket: Cryptan-Platform-MVP1, JP-soccer, RoyalJapan, and SettleMint, with variant naming conventions (v1, master, demo, platform, server) creating near-duplicate repositories to increase execution probability.
The campaign employs three distinct execution paths that all converge on the same staged C2:
Path 1 — VSCode Workspace Execution: Repositories include .vscode/tasks.json configured with runOn: "folderOpen", triggering automatic execution when a developer opens and trusts the project folder. A dictionary-based fallback provides redundancy. The execution chain retrieves a JavaScript loader from Vercel staging infrastructure (e.g., price-oracle-v2.vercel[.]app) and executes it via Node.js.
Path 2 — Build-Time Execution: Malicious logic embedded in trojanized application assets (e.g., modified jquery.min.js) triggers when developers run npm run dev or start the server. The trojanized asset decodes a base64-encoded URL, retrieves a Vercel-hosted loader, and executes it in-memory.
Path 3 — Server Startup via Environment Exfiltration: Backend modules decode a base64 endpoint from .env (AUTH_API variable), POST the entire process.env to the attacker server (exposing cloud keys, database credentials, API tokens), then execute returned JavaScript via new Function("require", response.data)(require) — achieving in-memory RCE within the Node.js server process.
Stage 1 C2 functions as a lightweight registrar: it profiles the host, polls a registration endpoint at fixed cadence, receives a durable instanceId for correlation, and can execute bootstrap JavaScript via new Function(). Stage 2 upgrades to a persistent tasking controller communicating with separate C2 IPs on port 3000. It polls for messages[] arrays of JavaScript tasks, executes them via separate Node interpreters (piping via STDIN), supports identity rotation, kill switches, error reporting, directory browsing (/api/hsocketNext, /api/hsocketResult), and staged file upload (/upload, /uploadsecond, /uploadend).
The campaign targets developer systems containing high-value assets: source code, environment secrets, SSH keys, cloud credentials, and access to build/deployment infrastructure. Cross-platform (Windows, macOS, Linux) via Node.js runtime.
MITRE ATT&CK techniques used in TL-2026-0139
collection
T1005 Data from Local System; T1074.001 Local Data Staging
discovery
T1016 System Network Configuration Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery
defense-evasion
T1027 Obfuscated Files or Information; T1027.007 Dynamic API Resolution; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution
exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
execution
T1059.007 JavaScript; T1072 Software Deployment Tools; T1204.002 Malicious File
command-and-control
T1071.001 Web Protocols; T1102.001 Dead Drop Resolver; T1105 Ingress Tool Transfer; T1571 Non-Standard Port
initial-access
T1195.002 Compromise Software Supply Chain; T1566.002 Spearphishing Link
credential-access
T1539 Steal Web Session Cookie; T1552.001 Credentials In Files
privilege-escalation
T1546 Event Triggered Execution
persistence
Affected products and versions in Malicious Next.js Repositories
- Microsoft — Visual Studio Code
Vulnerable versions: All versions with Workspace Trust disabled
Fixed in: Workspace Trust enabled (default since 1.57) - Node.js Foundation — Node.js
Vulnerable versions: All versions - npm — npm CLI
Vulnerable versions: All versions (lifecycle script execution) - Atlassian — Bitbucket
Vulnerable versions: Platform (hosting malicious repos) - GitHub — GitHub
Vulnerable versions: Platform (hosting malicious repos)
Remediation for Malicious Next.js Repositories
Immediate actions
- Search for and remove any repositories matching Cryptan-Platform-MVP1, JP-soccer, RoyalJapan, or SettleMint naming patterns
- Block Vercel staging domains listed in IOCs at proxy/firewall
- Block C2 IPs: 87.236.177.9, 147.124.202.208, 163.245.194.216, 66.235.168.136
- Audit .vscode/tasks.json files in all cloned repositories for runOn: folderOpen
- Rotate all environment variables, API tokens, and credentials on affected developer machines
- Revoke and rotate cloud access keys (AWS, Azure, GCP) exposed via process.env exfiltration
Workarounds
- Review all .vscode/tasks.json, next.config.js, and jquery.min.js files before opening/running untrusted repos
- Run untrusted assessment projects in isolated VMs or containers
- Disable VSCode automatic task execution for untrusted workspaces
Longer-term hardening
- Enable VSCode Workspace Trust and Restricted Mode as default for untrusted repositories
- Implement repository vetting process for recruiting technical assessments
- Deploy EDR monitoring for Node.js processes making unexpected outbound connections
- Enforce least-privilege for developer accounts and build identities
- Separate production credentials from development workstations
- Use short-lived tokens instead of persistent credentials on dev machines
Weaknesses (CWE) in Malicious Next.js Repositories
CWE-506, CWE-829, CWE-94
Timeline of Malicious Next.js Repositories
- OpenSource Malware blog documents DPRK malware using VSCode dictionary files — related Contagious Interview cluster. Source: https://opensourcemalware.com/blog/contagious-interview-malicious-dictionary
- Jamf publishes research on threat actors expanding abuse of Microsoft Visual Studio Code — same campaign cluster. Source: https://www.jamf.com/blog/threat-actors-expand-abuse-of-visual-studio-code/
- The Hacker News reports North Korea-linked hackers targeting developers via malicious VS Code projects. Source: https://thehackernews.com/2026/01/north-korea-linked-hackers-target.html
- Microsoft Defender Experts detect suspicious outbound connections from Node.js processes to attacker-controlled C2 infrastructure. Investigation begins.
- Analysts expand scope by pivoting on shared code structure, loader logic, and repository naming patterns. Multiple repository families identified: Cryptan, JP-soccer, RoyalJapan, SettleMint.
- Microsoft publishes full advisory with expanded IOC list (4 new Firebase-themed Vercel domains), 5 KQL hunting queries for Defender XDR, Path 3 backend RCE detail (AUTH_API env var + new Function() execution), staged upload workflow endpoints (uploadsecond/uploadend), and Defender coverage matrix. Source: Microsoft Security Blog
- Microsoft publishes detailed advisory with full IOCs, hunting queries, and mitigation guidance. Source: https://www.microsoft.com/en-us/security/blog/2026/02/24/c2-developer-targeting-campaign/
- As of 2026-05-29, this DPRK Contagious Interview/DEV#POPPER developer-targeting campaign remains active and expanding, with a Microsoft follow-up advisory (2026-03-11) and April reporting of 1,700+ malicious packages across 5 ecosystems plus 197 new OtterCookie npm packages. No CVE applies (social-engineering supply chain); the actor is undisrupted and "rapidly re-uploads after takedowns," so it stays ACTIVE rather than contained.
Sources cited for Malicious Next.js Repositories
- Microsoft: Developer-targeting campaign using malicious Next.js repositories
- Jamf: Threat Actors Expand Abuse of Microsoft Visual Studio Code
- The Hacker News: North Korea-Linked Hackers Target Developers via Malicious VS Code Projects
- OpenSource Malware: New DPRK Malware Uses Microsoft VSCode Dictionary Files
- VSCode Workspace Trust Documentation
- Microsoft Defender for Endpoint: Attack Surface Reduction Rules
- Microsoft Entra ID Protection: Investigate Risk
- MITRE ATT&CK: Supply Chain Compromise
Threats related to Malicious Next.js Repositories
- Famous Chollima (DPRK) npm Supply Chain — Pastebin Text Steganography Dead-Drop Resolver, 17 Malicious Packages, Vercel C2 Infrastructure
- Contagious Interview IDE Task Hijacking — North Korean BeaverTail/PyLangGhost/GolangGhost via VS Code & Cursor Tasks, GitHub Gist Staging, Developer Targeting
- EtherRAT: DPRK-Linked Vishing Campaign Abuses Microsoft Teams and Ethereum Smart Contracts to Deliver Blockchain-Resilient Node.js RAT
- Joyfill npm Supply-Chain Compromise: @joyfill/components and @joyfill/layouts Ship Obfuscated Worm-Like RAT and Credential Stealer
- Contagious Interview: DPRK Campaign Delivers OtterCookie and FlexibleFerret Backdoors via Fake Developer Job Interviews
- PolinRider DPRK Supply-Chain Campaign: Confirmed GitHub Footprint Grows 6.5x Since March (JADESNOW/Beavertail/InvisibleFerret Loaders, DEV#POPPER & OmniStealer Payloads)
Detection coverage for TL-2026-0139
As of 2026-02-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0139 across Splunk SPL, Microsoft KQL and Sigma, covering 47 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.