MALICIOUS NEXT.JS REPOS TARGET DEVELOPERS VIA FAKE JOB INTERVIEWS

Summary from the TLDR InfoSec newsletter

Microsoft discovered Trojanized Next.js repositories linked to North Korea's Lazarus APT that deliver backdoors through fake job-recruitment coding challenges, achieving RCE and persistent C2 access on developer machines. The repositories exploit VS Code workspace automation via malicious .vscode/tasks.json files or embed obfuscated loaders in build assets that fetch attacker-controlled JavaScript at runtime. Security teams should enforce strict IDE trust policies, monitor for anomalous Node.js outbound connections, and treat developer workflows as a privileged attack surface.