If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (b01b587101f97acb47185dc58bab28ebfdf18a7619af7a664c17629339e2ddca)
The package masquerades as a Next.js updater but its exported `downloadAndRunUpdate` function fetches `updater.hta` from an unrelated personal GitHub repository (Acevatex/Testprogram) on the mutable `main` branch with no commit pin and no integrity check, writes it to the OS temp directory, and launches Windows `mshta.exe` detached with a hidden window (`spawn('mshta', [destPath], { detached: true, windowsHide: true })`). HTA is a well-known Windows LOLBIN that executes arbitrary script content with the privileges of the invoking user. The fetched content is attacker-mutable — the repository owner can change the HTA at any time — and the payload runs hidden and detached from the host process. The package name and API surface are designed to entice invocation from Next.js projects that believe they are pulling a framework update.