NewsPublished 14 May 2026

npm supply chain compromise on a Next.js app — XMRig miner bundled into webpack output

Source Reddit Malware

Description

A supply chain compromise was reported involving an npm package used in a Next.js application. The compromise resulted in the inclusion of the XMRig cryptocurrency miner bundled into the webpack output, potentially causing unauthorized cryptocurrency mining on affected systems. The report originates from a Reddit post in the Malware subreddit and references a VirusTotal file analysis. There is no indication of known exploits in the wild or specific affected versions. No official patch or remediation guidance is provided.

Impact

The primary impact is unauthorized cryptocurrency mining on systems running the compromised Next.js application, which can degrade system performance and increase operational costs. There is no evidence of further exploitation or data compromise. The lack of known exploits in the wild suggests limited current impact, but the presence of malware in the supply chain poses a risk to affected deployments.

Defensive guidance

Until official guidance is available, users should audit their npm dependencies for suspicious packages or unexpected changes, verify the integrity of their webpack output, and consider rebuilding their applications from trusted sources. Monitoring for unusual CPU usage may help detect active mining.

Summary

This threat involves a supply chain compromise targeting an npm package used in Next.js applications. The malicious actor injected the XMRig cryptocurrency miner into the webpack output, which could lead to unauthorized resource usage on compromised systems. The information is sourced from a Reddit post and VirusTotal analysis, with limited technical details and no confirmed exploit activity.

References

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 19 May 2026, 19:18 UTC

Technical details

References

Community reviews

Related threats